Andrew Northern
Kansas City, Missouri, United States
2K followers
500+ connections
Articles by Andrew
-
Fake Zoom Launcher Leading to Ledger and Trezor Recovery-Phrase Theft + A Third Secret Thing (???)
Fake Zoom Launcher Leading to Ledger and Trezor Recovery-Phrase Theft + A Third Secret Thing (???)
Summary I found this while hunting for potentially malicious pages in the Censys data set. It initially looked like a…
1 Comment -
Targeted OSHA Citation Campaign
Targeted OSHA Citation Campaign
Observed: 2026-08-19 while conducting a proactive hunt for net-new malicious web based threats in the Censys data set…
1 Comment
Activity
2K followers
-
Andrew Northern shared thisThis is my latest research with the #CENSYSARC team at Censys. https://lnkd.in/g5nyvEJA Multi-stage Powershell loader with the ultimate payload hidden inside a fake MP4 file 📼 . Some pretty wicked tradecraft here. Check it out 👇 👇The Video That Plays You: Fake MP4 File Carries Malicious Payload - CensysThe Video That Plays You: Fake MP4 File Carries Malicious Payload - Censys
-
Andrew Northern reposted thisAndrew Northern reposted thisI'm stoked to be speaking at Labscon this year with Marc Rogers. Last year we presented on a network of IoT devices sold under a maze of shell companies. This year, we are going even further down the rabbit hole. https://lnkd.in/genuqZ_Y
-
Andrew Northern shared thisWhile hunting in the Censys data set for malware I ran into the strangest host impersonating Zoom and a whole lot more. 👇Fake Zoom Launcher Leading to Ledger and Trezor Recovery-Phrase Theft + A Third Secret Thing (???)Fake Zoom Launcher Leading to Ledger and Trezor Recovery-Phrase Theft + A Third Secret Thing (???)
-
Andrew Northern shared thisThis is a fantastic opportunity for someone with a very specific set of skills and the right mentality.Andrew Northern shared thisWe are hiring threat researchers to join Adversary Operations. If you think you have what it takes, lets get after it: GreyNoise Intelligence is hiring a Threat Researcher https://lnkd.in/e3_i76Hh via @greenhouse
-
Andrew Northern shared thisAn OSHA penalty notice is designed to create urgency. This lure turns that urgency into code execution. I analyzed an “OSHA Citation and Notification of Penalty” phishing page that uses a fake verification flow to copy a PowerShell download cradle to the victim’s clipboard. The page then guides the victim toward executing it, retrieving the next stage from audit-records[.]com. The infrastructure reveals a broader operation: • One host serving the OSHA lure • 16 related subdomains resolving to the same IP • A recently issued wildcard TLS certificate • Subdomains impersonating USAA, Citi, Apple ID, Microsoft sign-in, and online banking This is more than a single lure page. The shared DNS, certificate, and naming patterns suggest infrastructure staged for multiple credential-phishing campaigns. The article includes the decoded JavaScript, Censys pivots, infrastructure analysis, and indicators for threat hunting. Read the full analysis 👇 #ThreatIntelligence #CyberSecurity #Phishing #PowerShell #OSINT #CensysARC #Censys
-
Andrew Northern posted thisGood morning. ☀️ Do you find value in tactical intelligence or technical content that is shared on this platform? I would love to tailor my content to my audience here. What is your preference? Please comment and share for visibility.
-
Andrew Northern shared thisI had the pleasure of digging into some errTraffic v4 activity with Aidan Holland and Brandon Levene this week in the Censys dataset. Here is a quick update on what we found. 🕵
-
Andrew Northern shared thisOver the past few months, I’ve had the pleasure of working on something truly special alongside an incredible group of people at Censys. Earlier this week, Censys AI Investigations entered closed beta for our Adversary Investigations customers. Investigations have never been just about finding infrastructure. The hard part is connecting scattered indicators, understanding why they matter, and turning that evidence into action. That’s what we set out to accelerate. Starting with a single indicator, a list of IoCs, or an intelligence report, AI Investigations examines historical activity, surfaces related infrastructure, profiles relevant hosts, and brings the findings together in a structured report. Every finding remains grounded in evidence derived from the Censys data set, includes a confidence score, and keeps the analyst firmly in control. What excites me most is the opportunity to make the investigative expertise of the Censys ARC team available to more defenders, helping practitioners move from “what?” to “so what?” in minutes. I’m incredibly proud of what this team has built and grateful to have played a part. And we’re just getting started. Read the introduction: https://lnkd.in/gmHPMhwW Censys customers interested in joining the beta can reach out to their Censys contact for access.
-
Andrew Northern reposted thisAndrew Northern reposted thisWe’re thrilled to welcome Andrew T. to GreyNoise as our new SVP of Adversary Operations ⚡ With deep experience spanning Google Threat Intelligence Group, Mandiant, and U.S. Marine Corps Forces Cyberspace Command, Andrew joins GreyNoise with a clear mission: build on our early visibility into edge device exploitation and ultimately help defenders move from retroactive awareness to proactive disruption. 🔗https://lnkd.in/eRWfWqbj Welcome to GreyNoise, Andrew!
-
Andrew Northern reacted on thisAndrew Northern reacted on thisI'm stoked to be speaking at Labscon this year with Marc Rogers. Last year we presented on a network of IoT devices sold under a maze of shell companies. This year, we are going even further down the rabbit hole. https://lnkd.in/genuqZ_Y
-
Andrew Northern reacted on thisAndrew Northern reacted on this"Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure." https://lnkd.in/eUxzKt_pJustice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical InfrastructureJustice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure
-
Andrew Northern reacted on thisAndrew Northern reacted on thisToday, in honor of Women’s Equality Day, our Chief People Officer, Jasmine Burns, hosted a fireside chat with me and our team. I’ve had the privilege of being both a mentee and a mentor, and I believe one of the most meaningful things we can do for one another is share what we’ve learned along the way. I care deeply about this team. We work hard. We create wins. We challenge ourselves, and continually raise the bar. My hope in sharing candidly—both the lessons and the challenges—is that it helps support our team member's goals and better prepares them to navigate whatever obstacles and opportunities come next. That’s what Censys culture means to me: we celebrate our wins, share our mistakes openly, and learn and grow from both. Most importantly, we show up for our customers, partners, and for each other. When we invest in each other, we’re capable of doing great things—together!
-
Andrew Northern liked thisAndrew Northern liked thisIn the last 4 days since the operator registered the C2 domains, we've tracked this kit across 18 distinct builds on 36 endpoints, 6 ASNs, and 4 countries. Rather than chasing 18 rotating build hashes, we anchored on what didn't change - a console-hiding class name pattern combined with a %ProgramData% run-once marker. Interesting - the ISO-BMFF uuid box exists so parsers can carry private data without breaking. Anything inside it that a parser doesn't recognize, it's supposed to skip. Here, that skip-by-design box holds 99.95% of the file's bytes, while the container around it stays just well-formed enough to pass a filetype check. Full technical writeup with Censys queries, IOCs, pivots in the Censys ARC report from Andrew Northern.
-
Andrew Northern reacted on thisAndrew Northern reacted on thisSome of my friends have beeen getting laid off from Sublime today. It’s an dreadful post to write. I'll be reposting the people that I know over the coming days to try to get them in front of someone who can hire them. They're smart people. If you have roles or jobs open, or... know of someone else who does, please hit me up. I am lucky to be friends with talented people. Sorry for the part on LinkedIn that usually says "exciting new opportunities" or "embracing the next chapter". But this is not exciting, and i am not embracing it So... I'll skip the cliches and try to help some people move on to a job. Thank you all.
-
Andrew Northern liked thisAndrew Northern liked this2026-08-12 (Wednesday): #SmartApeSG #ClickFix activity leads to two RATs. A #pcap of the traffic, malware, artifacts and more info is available at https://lnkd.in/gv9x2XxV
Experience
Licenses & Certifications
Volunteer Experience
-
Cyber Patriots Mentor
United States Air Force
- Present 10 years 1 month
Science and Technology
I mentor a sponsored high school after school program that competes nationally. This program is focused on securing networks and endpoints against intruders.
My experience as a red team operator helps to reinforce the value of hardening systems.
Honors & Awards
-
Phi Ro Pi National Forensics Tournament 3rd in Nation
-
Languages
-
English
Native or bilingual proficiency
-
Spanish
Limited working proficiency
Explore more posts
-
Colton Porter
Another vulnerability just hit CISA's Known Exploited Vulnerabilities catalog. That means someone's actively using it in the wild. The KEV catalog isn't just a theoretical list. These are vulnerabilities that attackers are exploiting right now against real organizations. When CISA adds something here, it's based on concrete evidence of active exploitation. Here's what matters: if you're running vulnerability management programs, the KEV catalog should be your priority list. Not just another feed to monitor, but your "fix this first" roadmap. The difference between a disclosed vulnerability and an actively exploited one is the difference between theoretical risk and immediate danger. The catalog exists because knowing what attackers are actually using helps defenders focus their limited resources where they'll have the most impact. https://lnkd.in/ervH2adY #cybersecurity #vulnerability #KEV
-
Damian Chung
2025 reality check: The average enterprise now runs 60–130 security tools. That translates to: • $3.5M+ wasted annually on overlap & shelfware • 1,200+ alerts per day → 45-day average dwell time • 75% of SOC analysts reporting burnout Tool sprawl isn’t just annoying — it’s the #1 preventable risk most companies still ignore. Check out Episode 27 of the DTF Cyber Podcast with a no-BS blueprint that actually works: → Inventory → Kill redundancies → Consolidate → Automate → Measure Real teams using this cut their stack 60-70% and slashed dwell time by 80%. If you’re a CISO, SecOps lead, or just tired of alert fatigue — save this post. #CyberSecurity #ToolSprawl #SOC #SecurityOperations #CISO #BlueTeam
2 Comments
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content