hakan “:verified:”

Hi there. I. am working as a reporter and covering cybersecurity, mostly I'm interested in APT-related research. I'm with "paper trail media" and Der Spiegel.

If you want to check out the work I'm doing, here are some useful links: https://linktr.ee/hakantanriverdi

twitter: https://twitter.com/hatr/status/1589374562957156352
articles etc.: linktr.ee/hakantanriverdi

Last Notes

2026-10-12 13:06:15 UTC

Super interesting blogpost by DomainTools
"Looking closer, the engineer noted the flood originated with a single domain, and that one domain now accounted for up to 500,000 observations per second on our network."
"To me, this largely looked like a very voluminous emergency offsite backup."
https://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict

2026-09-14 10:02:37 UTC

"That said, we should not expect the public to understand LLMs, critical infrastructure, bioweapons, extinction biology, etc. — that burden must lie with those making the claim. The lesson that I learned (shamefully) decades ago is that domain experts, by way of their expertise, implicitly hold the public’s trust — and we must not abuse it. It is incumbent upon us to be circumspect in our claims — and maximally so when raising the alarm."
https://bcantrill.dtrace.org/2026/09/13/the-contagion-of-fear/

2026-08-19 06:52:55 UTC

Thorough explanation of how the EncroChat-hack allegedly worked
https://www.computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network

2026-05-04 04:55:39 UTC

"Marketing agencies are pitching influencers deals such as $5,000 per TikTok video to amplify Build American AI’s messaging about how China’s technological rise should be seen as a threat"
https://www.wired.com/story/super-pac-backed-by-openai-and-palantir-is-paying-tiktok-influencers-to-fear-monger-about-china/

2026-03-03 17:52:44 UTC

If you're following the situation in Iran, this one is of interest to you.
Today, we're publishing a story that I find very important for many reasons.
We can prove how the regime in Iran is using facial recognition software to surveil its citizens. We have obtained videos showing the software in a live-scenario, at metro stations in Teheran. We have contracts, and we have had a look at the code, built by the Russian company Ntechlab whose algorithms are deemed to be best-in class.
We spoke with a dozen people who know the regime, either because they had to flee after being imprisoned or from a technical point of view.
All of this, and more, you can find in our reporting, hashtag#EyesOfIran. Here are the links:
SPIEGEL: https://www.spiegel.de/ausland/iran-so-gnadenlos-spaeht-regime-die-eigene-bevoelkerung-aus-ein-insider-packt-aus-a-7990ef28-3c9d-427b-be9a-5f46d06bea6c?giftToken=7fdb6b96-b2f1-4799-b8ff-e55fed5496d1
Standard: https://www.derstandard.at/story/3000000310751/ein-regime-im-ueberlebensmodus-leak-zeigt-irans-massive-ueberwachung-im-land?ref=niewidget
ZDF: https://www.zdf.de/play/magazine/frontal-das-magazin-100/datenleak-iran-ueberwachung-gesichtserkennung-software-100
Forbidden Stories: https://forbiddenstories.org/iran-regime-monitors-citizens/

2026-01-08 14:36:24 UTC

So, Enisa, the cybersecurity agency of the EU, releases a yearly Threat Landscape. In the 2025 edition, they've used AI. And the AI introcuded loads of errors. Five percent of all the links end up 404
One of the researchers.(@npub1dnk…9swz) told me: "You just had to click once", to check whether the links are valid or not. Upon closer inspection, you'd notice something was amiss just by looking, i.e., Enisa referenced a blogpost by MSFT. The link has "APT29" in it. Microsoft is very picky about those names.
They even have a blogpost about their naming convention (https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming) What other companies call APT29, MSFT calls "Midnight Blizzard". The AI apparently didn't dig those subtleties.
Here's the story
https://www.derstandard.at/story/3000000303214/peinliche-panne-bericht-der-eu-agentur-fuer-cybersicherheit-mit-ki-verfasst-und-fehlerhaft

2026-01-08 09:13:14 UTC

Reposting here as well, in case some of y'all missed it
Quick item on using RegEx to find infrastructure used by DPRK-actors (and loads of Github repositories)
https://buttondown.com/readwrite/archive/edition-6-using-regex-to-catch-state-sponsored/

2026-01-04 21:48:08 UTC

"Die Zeit" reveals that German foreign intelligence, in a multi-year campaign, intercepted Barack Obama's phone calls while aboard Air Force One because the encryption was flawed. Angela Merkel didn't know about it.
https://www.zeit.de/politik/ausland/2026-01/bnd-barack-obama-air-force-one-angela-merkel