After thinking on it over the weekend, I have a couple of thoughts about this panel (both a bit negative + a tad contrarian it seems, though maybe just among the 6 panelists):

$CCIV / LUCID MOTORS

DD Thread ⤵️

The $CCIV leadership team:

I will highlight who I believe are the key players.

Starting with Sir Jony Ive, who was the Chief Design Officer at Apple Inc for over 20 years. (Connections to Apple are never a bad thing..)

Andrew Leveris is the former CEO of The Dow Chemical company who also just happens to be a board member of, you guessed it - Lucid Motors, further supporting SPAC rumors.

As the former CEO of Ford, Mulally brings a wealth of motor industry experience to Churchill Capital and Lucid Motors.

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

Seeing a ton of (warranted) criticism re Dems on impeachment — but like where was everyone? We know politicians don’t act boldly if we’re not in the streets to make them. But multi million dollar “movement” orgs are writing petitions & posting graphics instead of organizing

I will always remember the first impeachment trial- pre-Covid-, when a mere 10,000 people marched in NYC. Dems are cowardly and ineffective, and Republicans are fascists but also the grassroots left is all over the place and has some reckoning to do.

These groups have millions of people on their email lists. How are they using that platform? There was zero coordinated national action(not emails, but action) re impeachment that I saw. Not even an ask to post something on social media or take a photo, let alone in person.

And I’m putting the focus on the people with money and resources to organize rather than on Individuals trying to survive a pandemic intentionally.A smattering of groups did some impeachment texting or phonebanking. That’s all I know about.

And because of this lack of direction from the people with resources (seeing this in the climate movement too) local groups or affiliates are getting wrapped up in super local politics, which while fine, is not going to move the national Democratic Party the way we MUST.

The question of how TV news amplifies disinformation is often discussed but we have little concrete research on this subject. So we partnered w/ @r_macdonald & @kalevleetaru to understand how cable TV amplified Trump’s tweets. The results are interesting.

Between Jan 1 2020 and Jan 8 2021, CNN, Fox News and MSNBC spent 32 hours showing Trump’s tweets on screen, eg. blowing them up full size. This doesn’t include when anchors and correspondents mentioned things Trump had tweeted.

We then focused on the ways in which the three networks broadcast Trump’s tweets that falsely claimed the election would be fraudulent (before Nov 3) and was actually stolen (after the election).

In the weeks after the election, the cable news networks broadcast nearly three times as many Trump tweets about election fraud than they had in the nine months leading up to it. They even broadcast Trump’s old tweets after he was removed from Twitter in January.

4 points: 1) there was a drumbeat of tweets undermining the election throughout the summer. Many were broadcast & there were no labels from Twitter until middle of Sept. We need more research to understand how a foundation supporting the false narrative was laid by platforms & TV