So I tried to explain the GameStop situation to some of my students using Pokémon. And I think what I said is mostly true so I figured I would share here (A thread)
#GameStop

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

A THREAD on how most real estate folks structure deals with outside investors.

Most people utilize the "preferred equity" structure when they raise money from outside investors. They "syndicate" deals.

Here's the basics:

The person (or team of people) putting the deal together is the "sponsor". Also called general parter. Referred to on twitter as the GP.

They find the property, do all the work, hire the management company and take fees. They often co-sign debt and always secure the financing.

The investor is generally passive, doing no work and putting in cash. This is the "limited partner". Referred to on twitter as the LP.

They don't co-sign debt. They simply read reports and ask the sponsors questions and cash checks every month (if the deal is going well).

There are two equity classes.

"Preferred equity" belongs to the LPs. Cash talks, so this is a higher class of shares. They are first in the "capital stack" behind the debt (bank loan).

"Common equity" belongs to the sponsor. They are generally last in the capital stack.

Sponsors generally co-invest. That means they hold both equity classes. A 10% co-invest is standard.

That means the GP has skin in the game. His 10% co-invest makes him both an LP and a GP.

There is a world shortage of chocolate. People are dying because they do not eat enough chocolate. A company, AstraChocolate, one of the few companies that knows how to manufacture chocolate bars, enters into contracts with governments worldwide. 1/

Most of these governments agree to fund AstraChocolate's efforts to research and secure production of highly nutritient chocolate bars. In exchange, AC promises it will deliver X chocolate bars per day to governments once they are produced. 2/

Because edible, safe, chocolate bars need to be approved by national and international regulators, their production and manufacturing takes a while. To ensure a smooth supply chain, AC and other similar companies use factories all around the world. 3/

In Europe, AC uses mainly three manufacturing sites: one in the UK, one in Germany and one in Belgium. In its dealings with governments, AC has promised to deliver 500m of chocolate bars to the EU and 100m to the UK by March 2021. 4/

Now this is a mighty task and there are bumps along the way. Nobody has ever produced edible, safe, super-nutrient chocolate bars at that speed and under that much public scrutiny. So AC and other, similar companies, like Cfacao-BionChoc run into some supply problems. 5/

Over the last week, I've been blocked by various people, including an MSP, for allegedly being a conspiracy theorist, trying to sow division within @theSNP and #indy ranks.

Nothing could be further from the truth. I want independence for Scotland, plain and simple.

But I still have the right to challenge people if I think something is wrong, legally or morally, as recent events within the SNP seem to be.

But anyway, I'm not talking about that. Today I'm looking at the @NowScotlandNow logo.

I'm not a fan. Just to be clear, I want Scottish Independence. But the logo for the new organisation, unfortunately, doesn't work as well as the previous YES ones. It's a mix of the colour and the font used, which presumably is referencing Charlies Rennie Mackintosh.

The italics and thin font means it doesn't stand out. Plus, I associate Mackintosh more with Glasgow than Scotland as a whole. So I took some of the elements of the last two and looked at alternative fonts (that are all free BTW)

This font is called ChuckFive. It's big, bold and brash and you can read it a mile off.