Sean Lyngaas
@snlyngaas
Followers
14K
Following
15K
Media
897
Statuses
22K
@CNN cybersecurity reporter | Tips: Signal 202-355-8471 | [email protected] | @DukeU/@FletcherSchool alum | Proud Dad | @LFC
Washington, D.C.
Joined April 2010
New —> We tied the email addresses reportedly used in non-credible bomb threats on Election Day to a much broader campaign of (non-credible) bomb threats to LGBTQ+ events in multiple states this summer and other possible targets abroad:
29
491
696
Raffensperger asks Elon Musk to take down the fake video purporting to show Haiti immigrants gaming the voting system in Georgia. This video is entirely fictional and false. Experts have attributed the fake video to a Russian troll farm:.
659
10K
23K
New —> @elonmusk told SpaceX engineers to cut off Ukrainian submarine drones’ access to Starlink satellites as the Ukrainians prepared a sneak attack on Crimea last yr, per new Musk biography by Walter Isaacson. Musk feared a Russian retaliation via nukes.
291
1K
2K
NEW and exclusive: The story of a Ukrainian man who sought to avenge the war by leaking a trove of embarrassing documents on a notorious Russia-linked ransomware gang. “I cannot shoot anything, but I can fight with a keyboard and mouse.” #Urkraine
18
571
2K
Scoop —> The Biden administration is expected to name Kim Wyman, a Republican secretary of state who challenged former President Donald Trump's false claims of election fraud, to lead the DHS’s election security efforts
82
372
1K
New --> Alexander Vinnik, a Russian man accused of running a $4-billion bitcoin exchange that allegedly facilitated cybercrime and drug trafficking, has been extradited from Greece and is on a plane to the US, his lawyer tells CNN:
25
413
908
*Personal note* —> After 3.5 fulfilling years at @CyberScoopNews, I’m joining @CNN as a cybersecurity reporter next month. I’m excited and humbled by the opportunity, grateful for those who have supported me in my career, and emotional to leave the best colleagues around.
182
43
1K
Hi. It's my first day on the job at CNN. Per usual, I'm covering cybersecurity, hacking, espionage, and other forms of digital skullduggery. Sources old and new: Get at me with news tips and scoops. DM for Signal or Wickr.
51
50
940
US military's hacking unit publicly acknowledges taking offensive action to disrupt ransomware operations
34
287
789
First on CNN: Biden to convene 30 countries to crack down on ransomware threat
16
205
661
“Krebs and his agency had spent years going about their business and avoiding the wrath of a president who cares little for cybersecurity, but CISA’s fact-based insistence that the vote was secure and free of any notable fraud proved too much for the White House.”.
One of the defining moments on the cybersecurity beat in 2020 was the firing of Chris Krebs. Revisit how @snlyngaas covered the news with insight and inside sources
13
127
608
ICYMI. Yesterday was a wild day of infosec news. Allow me to recap our coverage:.
15
174
615
“Fox quietly amended the digital story and then removed it from its website following more complaints from the Marines but still has not apologized or corrected the erroneous report, which had been based on a false claim quickly retracted by a congressman.”
40
220
497
Exclusive —> Special counsel scrutinizing February 2020 meeting where Trump praised US election security protections
18
167
467
White House: Biden to sign "National Security Memorandum" that will focus on recruiting national security professionals, in part by "creating additional pathways for Americans" with crucial skills in cybersecurity, math, engineering, etc. to work for the government.
21
133
501
New: White House attributes DDoS attacks on Ukrainian organization this week to Russia's GRU -- Anne Neuberger said it from White House podium just now.
13
251
498
New statement from Discord (1/2): “We have identified an account that appears to be linked to the suspect; it was rarely utilized and we have found no evidence that it was used to plan this incident or discuss his political views . .
8
175
490
To target infosec researchers, North Korean attackers curated a blog with guest posts from actual researchers on real software bugs. The attackers were able to install an in-memory backdoor on fully patched Windows 10, according to Google:
13
221
476
The White House has told @sarasendek, the longtime head of public affairs for @CISAgov, that her services are no longer needed, Sara tells me. Today is her last day on the job.
35
282
399
.@C_C_Krebs says he is "really impressed" by the Wyman pick. "Kim doesn't see R or D, red or blue. She's committed to delivering democracy for the nation. Everyone wins here."
18
93
402
Scoop from @jaketapper and @jamiegangel: “Multiple people who know Rick Perry confirmed to CNN that the phone number the committee has associated with that text message is Perry's number.”
81
114
387
New —> Election officials, Republican & Democrat alike, have been trying to present Elon Musk with accurate information about voting & the election process, with 1 going as far as trying to pass him info through an intermediary. To little avail
36
179
357
Gabe Sterling, the chief operating officer in Georgia’s Secretary of State’s office, rebukes an RNC official in Georgia for propagating the suspected Russian disinformation:.
No responsible person would retweet this ridiculously obvious lie and disinformation. Those doing so are acting to further the efforts of America’s enemies and undermine the security of our nation. The judgement of those sharing this should be questioned in all things.
10
168
361
Scoop —> Cybersecurity researchers, with the help of the NSA, are exposing a suspected foreign hacking campaign that has targeted multiple US defense contractors.
13
183
362
Exclusive: Biden administration to accuse Russia of sustained effort to influence 2024 election, w/ @evanperez, @kylieatwood & @ZcohenCNN. More info to come .
30
127
351
.@RepSeanMaloney calls the US exposure of Russian war plans prior to the invasion of Ukraine the "most consequential success of the [intelligence community] since the Cuban Missile Crisis.".
2
60
321
Thread ---> With #Ryuk bearing down on the computer networks of U.S. hospitals, security companies and the feds are releasing a lot of data on the ransomware and the criminals behind it. Here's a list of public intel that I'll update as more is released.
8
149
379
New --> @jackhcable found a glitch in the payment system used by a new ransomware gang, and saved victims $27K in potential losses, he says. A family friend called him yday asking for help. Cable helped the friend, and 50 pple total, get their data back.
9
71
347
.@VP announces that the US has joined an agreement of 80 countries & 100s of corporations to hash out norms & mobilize defensive resources in cyberspace. The French government launched the initiative in 2018, but the Trump administration declined to join.
3
119
264
New —> US officials say 1000s of North Koreans are landing jobs at tech firms overseas, offering a critical source of funding for DPRK weapons programs. I spoke to 1 crypto entrepreneur who, the FBI told him, had a North Korean on the payroll for months.
12
182
290
Scoop --> DHS assesses that Russia would consider conducting a cyberattack on US if Moscow perceived that a US/NATO response to a potential Russian invasion of Ukraine "threatened [Russia's] long-term national security."
44
200
292
New --> The same Russian group behind the SolarWinds intrusions has breached multiple technology firms in recent months as part of an effort to target US and European government organizations.
12
250
286
And the purge continues: The White House has also forced out Krebs’ deputy, Matt Travis, a source familiar with the matter tells me. Travis will leave the agency this week.
8
136
254
SCOOP from @ChrisCarrega and me: US seized $6M in ransom payments and expected to charge Ukrainian over Kaseya ransomware attack, which infected up to 1,500 firms worldwide:
9
135
253
Microsoft “assesses that the malware, which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom.” #Ukraine.
Microsoft identified a unique destructive malware operated by an actor tracked as DEV-0586 targeting Ukrainian organizations. Observed activity, TTPs, and IOCs shared in this new MSTIC blog. We'll update the blog as our investigation unfolds.
7
179
268
This boy is fighting for his life right now. Send ❤️ and strength.
Some cyber espionage groups never take a day off. #APTDormantHound says, “To hell with that.” #Happy4thofJuly
23
14
270
As a political appointee, Sendek would have left government service by Jan. 20. But she was still actively helping run CISA's response to the #SolarWinds hack as well as the agency's work in support of the Georgia runoffs.
5
110
240
NEW from @RosalesReport and @murphy : American man living in Massachusetts says he was paid $100 to spread the fake video purporting to show Haitians voting multiple times in Georgia. US intel says the video was a Russian disinformation operation:
7
150
251
NEW -- > AG Merrick Garland says that Justice Department has disrupted GRU-controlled botnet that had infected thousands of devices "The Russian government has recently used similar infrastructure to attack Ukrainian targets," Garland said in prepared remarks . More to come.
3
116
239
“Even among Trump loyalists, Patel is widely viewed as a controversial figure and relentless self-promoter whose value to the president-elect largely derives from a shared disdain for the so-called deep state.”
78
123
290
Really excited to be a dad. Counting the days, weeks, months. A little angel on the way.
57
1
264
Conversations between US & Russian military brass have been very sporadic in recent months, & “I can’t really imagine the Russians would answer the phone right now to try to explain what’s happening until they have a better handle on this” -@OrenCNN to @kaitlancollins #Prighozin.
5
44
258
Fox News’ reporting from ballot-counting centers refutes baseless claims from the White House
8
70
222
Current & former Pentagon officials are baffled that Teixeira’s superiors were apparently aware of warning signs that he was taking notes in a SCIF, etc. “This is negligence on the part of the chain of command.” w/ @halbritz. @ZcohenCNN & @NatashaBertrand
19
79
231
Georgia election official says battleground state fended off cyberattack likely from a foreign country:
16
101
219
FBI and allies seize dark-web site of world’s most prolific ransomware gang
5
88
205
New —> Minutes after Biden announced sanctions, an FBI cyber official told business execs/state, local officials to be wary of ransomware attacks. Russia is a “permissive operating environment” for cybercriminals, one that "is not going to get any smaller.”
3
134
214
Riveting and revealing @RonanFarrow investigation on how the CIA allegedly retaliated against a DOJ prosecutor who blew the whistle on the source of data used in drug busts:
3
64
205
New Senate bill would "require device manufacturers and service providers to assist law enforcement with accessing encrypted data" and "create a prize competition to award participants who create a lawful access solution in an encrypted environment."
68
194
226
Sendek said she had planned to stay on the job in the coming days and that she was surprised to be asked to leave by the White House.
3
71
195
Good interviews with election officials like @Commish_Schmidt and @GabrielSterling.
“A republic….if you can keep it.” . Hear from GOP election officials from all over the country as well as @RepAGonzalez @RepLizCheney @AdamKinzinger and more about how close we came to having our democracy undermined. Tonight at 8 pm ET on CNN
18
34
206
Scoop ---> US to publish details on suspected Russian hacking tools used in SolarWinds espionage
2
134
200
Scoop --> Suspected state-backed hackers breached IT network at Port of Houston using 0-day last month. Breach was caught quickly; attacker wasn't in position to disrupt operations, per Coast Guard analysis obtained by CNN. Appears to be espionage
5
99
210
Microsoft just released new data on malware that the "SolarWinds hackers" have allegedly been using since April, a "highly targeted backdoor" that exfiltrates data from Active Directory servers.
1
108
202
The relatively muted Russian activity in cyberspace is due to defensive measures from the Ukrainians, “some of the challenges that the Russians have encountered, and some of the work that others have been able to prevent their actions,” Nakasone said.
5
48
199
I haven’t seen my parents in person in 16 months, since before the pandemic began. But the long wait ends this week, and they get to meet their first grandchild.
13
3
204
New —> The FBI executed a search warrant earlier this year for info that might help track down suspects affiliated with Emotet, the malware and botnet that has caused hundreds of millions of dollars in losses and haunted the internet for nearly a decade:
3
83
175
2/2: " . Discord strongly condemns violence of any kind, including political violence, and we will continue to coordinate closely with law enforcement.”.
0
33
209
NEW —> How Ukraine’s electric grid operator —-with the help of the US Air Force — quietly imported equipment custom-built to resist Russian electronic warfare to keep the lights on this winter.
5
64
189
New --> How hackers, Arnold Schwarzenegger and the State Department are trying to pierce Putin's digital Iron Curtain, w/ @kylieatwood, @b_fung, @DanaBashCNN and @KatieBoLillis .
5
63
187
"The Pentagon had a $145 million check ready to hand to me, literally,” Isaacson quotes Shotwell as saying. “Then Elon succumbed to the bullshit on Twitter and to the haters at the Pentagon who leaked the story.”.
3
26
185
In the meeting, Trump was so encouraged by federal efforts to protect election systems that he suggested the FBI and Department of Homeland Security hold a press conference to take credit for the work, sources said.
2
41
160
New —> A hacking incident in January caused a water tank in a small Texas town to overflow. A GRU-backed Telegram channel took responsibility (per Mandiant). I interviewed officials in multiple towns in north Texas on how they responded:
7
131
173
Scoop --> Chinese hackers have lurked in some US infrastructure systems for ‘at least five years,' US agencies conclude
13
116
169
“How am I in this war?” Musk asks Isaacson. “Starlink was not meant to be involved in wars. It was so people can watch Netflix and chill and get online for school and do good peaceful things, not drone strikes.”.
25
21
175
The EU formally attributes the hack of satellite provider Viasat, which knocked tens of thousands of satellite modems offline at the onset of the war in Ukraine, to the Russian government. Will the Biden administration follow suit with public attribution?
2
76
164
New FBI-led advisory on ransomware says an unnamed U.S. city spent $9 million rebuilding its computer systems rather than pay the $76K ransom to Robbinhood crooks:
12
45
172
LeMonde investigation finds that members of a French nuclear-armed submarine crew inadvertently shared sensitive information about the patrol schedule of the ship via the Strava workout app:
11
75
188
New —> The US Naval Criminal Investigative Service is investigating after multiple Navy personnel reported receiving unsolicited smartwatches in the mail that could be installed with data-stealing malware
5
91
137
New —> The Commerce Department is preparing to prohibit US companies and persons from using Kaspersky anti-virus software, citing national security concerns that the company has dismissed as unfounded, w/ @ZcohenCNN, @Phil_Mattingly & @evanperez
5
75
144
I love my daughter so much. She’s everything. That’s it. That’s the tweet.
7
4
162
New --> Russian hackers targeted NATO forces and diplomats to aid Ukraine war effort
9
100
134
Uhhh. the chief operating officer of a network security firm in the Atlanta area has been charged with hacking a medical center for profit.
6
77
148
I've said it many times before, & I'll say it many times again: 1 of the best parts of being on the cybersecurity beat is the wealth of technical knowledge available to you from nice people who want to help. It is fun & humbling learning from my #infosec peeps. Thanks, as always.
2
14
163
New statement from AT&T on outage today: “Based on our initial review, we believe that today’s outage was caused by the application and execution of an incorrect process used as we were expanding our network, not a cyber attack.”
10
77
157
It's surreal to watch #ransomware become the dominant topic of the White House presser, complete w/ a reporter's attempt to cast it thru a political, "is it a coincidence this is happening under this admin?" lens. Ransomware has finally gone from niche issue to cable primetime.
9
23
156
Follow the many CNN journalists on the ground in #Ukraine: @fpleitgenCNN, @clarissaward, @MarquardtA, @sebshukla, @jimsciutto, @ErinBurnett, etc. etc.
14
44
143
I wrote about @dotMudge, who the world now knows as the Twitter whistleblower but who the hacking community has seen as a moral compass for years, by talking to @dugsong, @spacerog & @daveaitel, among others:
6
57
152
New —> Iranian operatives have ramped up their attempts to influence and monitor the US presidential election by creating fake news outlets targeting liberal and conservative voters and by trying to hack an unnamed presidential campaign, per Microsoft.
11
109
126
New --> A deep dive into ransomware incidents in the manufacturing sector, including new details on Honeywell's handling of its recent hacking incident based on internal emails and sources.
3
68
148
New —> NSA collected intel in the closing weeks of the 2020 US election showing that Chinese & Iranian operatives had prepared deepfake content aimed at US voters. The tech was unimpressive, but it was a harbinger, w/ @ZcohenCNN & @evanperez
3
79
144
New —> Chinese hackers (Silk Typhoon) accessed information held by CFIUS, the powerful US inter-agency committee that can block foreign investments and real estate buys in the US on national security grounds:
10
113
156
New —> Hours after Alexey Navalny’s death, vigilante hackers stole data on 800K Russian prisoners and their contacts, changed prices for food in prison commissary to 1 ruble, according to data shared with CNN and statements from the commissary
2
88
137
"It's one of the biggest developments in a cybercrime case since President Joe Biden urged Russian President Vladimir Putin in June to crack down on hackers operating from Russian soil"
8
60
119
Scoop --> US officials offering training to election workers to avoid potentially violent confrontations with voters at the polls on Election Day.
4
71
125
“The former CIA operative said the MSS also tended to take more risks in Europe because it viewed the consequences of being caught as being less severe than in America.”.
INVESTIGATION #ChinaSpies. How a Chinese spy ran a Belgian politician as an intelligence asset — Joint investigation with @DerSpiegel & @LeMondefr based on 3.5 years of texts between the MSS case officer and his asset in Brussels.
0
46
128
Most Americans "are never going to run into the Russian . SVR. They're going to run into ransomware, business email compromise," @CyAlliancePrez says at @CSIS event, making a point about cybercriminals' broad impact on American lives.
3
31
131
Chris Krebs sued the Trump campaign, one of its lawyers, and Newsmax for defamation:
1
10
128
Some new reporting: intelligence and national security agencies + White House and others met yesterday to prepare for Russian hacking threats in light of #Ukraine situation. Among the topics discussed were ransomware groups that might rear their head.
20
49
125
NEW: The State Department was the federal agency first hit by the Chinese hackers. State then alerted Microsoft of the breach, a person familiar with the matter told CNN.
ICYMI overnight —> China-based hackers breached US government email accounts, Microsoft and White House say
2
77
117
"Experts who track online extremism told CNN the volume of violent rhetoric in the last 24 hours is as high as it was after the FBI’s search of Trump’s Mar-a-Lago property in August 2022." w/ @donie
11
69
116
New —> US accuses Russian intelligence agencies FSB and SVR of working hand-in-glove with 5 Russian-language media outlets to bolster domestic support for a potential Russian invasion of Ukraine, with @ZcohenCNN
8
78
118
The reader doesn't find out until the 20th graf that this NYT story is based on an AP interview:
3
20
112
New, Vladimir Dunaev, a 38-year-old Russian man accused of being a Trickbot malware developer, has been extradited from South Korea and made his initial court appearance today in Ohio, where he pleaded not guilty, per DOJ spox. Story to come.
4
30
123
Thank you for the supportive messages and prayers. They made a difference! Against the odds (the vet said it was “Hail Mary” time yesterday), Willis fought like a lion and is no longer on oxygen. Nothing short of a miraculous comeback.
This boy is fighting for his life right now. Send ❤️ and strength.
15
1
125
Thus ends a years-long duel between US and Russian authorities to try to get Vinnik into their respective custodies. Vinnik has been under indictment in the Northern District of California since 2017.
1
36
115