Great, Google misses another opportunity to adopt the @gayint@infosec.exchange threat actor naming scheme and instead invents yet another one: https://www.theregister.com/security/2026/07/27/google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy/5278749
Do I have to tap the https://xkcd.com/927/ sign again?
#infosec #threatintel #gayint
@cR0w@infosec.exchange
·
Jul 25, 2026
@cR0w@infosec.exchange
Analyst
infosec.exchange
One of the #GAYINT servers may or may not have been splashed by sewer water. I apologize for any downtime but I can assure you this stinks for me more than it does you. You will receive a refund prorated to the outage window on your next monthly bill.
nyan
@nyanbinary@infosec.exchange
Little goblin with catears. Unfinished projects, complaining about computers, reinventing the wheel (badly), has not fully read any docs since 2015. Certified cognitohazard. Proud bot parent to many failsons: @enojifier_bot @dreizehnzwoelf_bot Infosec related: https://infosec.exchange/collections/116931760660109009 Testimonials: "not helpful" @LucasWerkmeister "silly 😌" also @LucasWerkmeister All my opinions are that of my employer but they don't know it yet & I am not telling you were I work. Apropos: If you need some idiot to kick computers for purposes of making them secure hmu, this job fucking sucks (vulnerability management, automation/engineering for your soc/isrt, ...). PFP by Jen
infosec.exchange
Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR.
(from: https://unit42.paloaltonetworks.com/russian-webmail-espionage/ )
You can't tell me thats not a #GAYINT threat actor name 
Fritz Adalis
@FritzAdalis@infosec.exchange
Infosec Lurker | Technical Debt Collector It's not for fun, or any sense of community. It's just trying to dull the pain. I have friends everywhere.
infosec.exchange
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange
What's their #GAYINT name?
nyan
@nyanbinary@infosec.exchange
Little goblin with catears. Unfinished projects, complaining about computers, reinventing the wheel (badly), has not fully read any docs since 2015. Certified cognitohazard. Proud bot parent to many failsons: @enojifier_bot @dreizehnzwoelf_bot Infosec related: https://infosec.exchange/collections/116931760660109009 Testimonials: "not helpful" @LucasWerkmeister "silly 😌" also @LucasWerkmeister All my opinions are that of my employer but they don't know it yet & I am not telling you were I work. Apropos: If you need some idiot to kick computers for purposes of making them secure hmu, this job fucking sucks (vulnerability management, automation/engineering for your soc/isrt, ...). PFP by Jen
infosec.exchange
Replying to
@wall_e@ioc.exchange
@wall_e@ioc.exchange well, they gotta learn about the #GAYINT threat actor naming scheme at some point!
darf 
@darfplatypus@infosec.exchange
Known Threat, Top 1% Internet Race Car Driver Cross-Functional Millitary-grade High-Velocity CyberCloudBlockchainDevAppSecThreat-IntelOps Architech If your account is empty/looks fake, I'm not accepting your follow request. If it's your first night, you have to fight. Everything posted here should be considered a shitpost and in no way the official stance or opinion of my employer, or even considered a cohesive thought.
infosec.exchange
#gayint Snapchat feed when? 🤔
Eddie.
@infoseclogger@infosec.exchange
I am the man in the lighthouse for my org. Full #DFIR owner - IR, TH, TI, FOR. Alerting. Vuln mgmt. Threat mgmt. Brush up against policy. Teaching governance that Availability is part of security. Finally got my Masters. Sho'nuff. Living that Wisconsin life. The nightmare of cold call sales people. Good for the gander, good for the goose.
infosec.exchange
Replying to
@da_667@infosec.exchange
@da_667@infosec.exchange does #gayint have a pew pew map yet?
Kevin Beaumont
@GossiTheDog@cyberplace.social
Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions. I have Direct Messages disabled - you can send them, but I will never receive them.
cyberplace.social
Replying to
@GossiTheDog@cyberplace.social
I consulted the official #GAYINT threat actor mapping chart and made this diagram for Notepad++ hack attribution
Kevin Beaumont
@GossiTheDog@cyberplace.social
Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions. I have Direct Messages disabled - you can send them, but I will never receive them.
cyberplace.social
Replying to
@GossiTheDog@cyberplace.social
Notepad++ have today confirmed their auto process was compromised by Chinese nation state threat actors, in a supply chain hack: https://notepad-plus-plus.org/news/hijacked-incident-info-update/
This backs up my blog from late last year, with #GAYINT threat actor mapping to Funky Stamen.
The infrastructure and update mechanisms have since been tightened. For what it’s worth - entry was to telcos and financial services with interests aligned to China. Notepad++ dev did a great job treating issue seriously.
You've seen all posts