Will be a v ugly week, but impt to remember, short of the House flipping red by Friday, there's no remaining power mechanism in the U.S. capable of preventing Biden taking the presidency on Jan 20.

Everything else is just show. A shitshow, to be sure, but a show nonetheless.

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

WTO e-commerce #digitaltrade consolidated draft leaked by @bilaterals_org Some interesting things (1/n)

(2/n) Intermediary liability is included without brackets, normally meaning there is some agreement. The text is based on US proposals but has more extensive caveats and exceptions than existing US trade deals

(3/n) No agreement on cross-border data flows at WTO #digitaltrade consolidated text

(4/n) FWIW The UK's (and US) position on WTO #digitaltrade exceptions to the liberalisation of cross-border data flows vs the EU's. Guess which one is which

(5/n) Financial data may be included in the ban on forced localisation of computing facilities, but with many caveats. US regulators had pushed against this in the past but they seem to be losing the battle. Several alt texts. UK to bring more proposals.

Thread:
An explosive new criminal complaint against Martin Inacker, the former CEO of @wpmeurocom in #Germany shows Inacker potentially double crossing his #Saudi clients by colluding with #Qatar to cover up Doha's #Hezbullah's sponsorship in exchange for hush money.

According to the complaint, Inacker had kept the terms of his initial agreement with the #Saudi Ministry of Information (following his work with the Saudi Embassy in Berlin) secret from @wmpeurocom 's Board of Directors.

He had used unethical methods to promote a hyperbolized, if not outright mendacious, brochure that was supposed to improve the image of #KSA and the royal family. He had promised a list of high level political and business context to the Saudis as part of his business.

A strategy paper developed by Inacker was leaked to the papers showing unethical, and possibly illegal pressure on ten journalists to switch their "tone" on #KSA as a result of Inacker's lobbying efforts.

However, despite throwing these journalists under the bus, by his own admission Inacker did not appear to have succeeded in pressuring them to "switch their tone". This shows Inacker's duplicity: 1) he lied to his Saudi clients about his alleged success.

If you make more than $100k per year you should have a Virtual Assistant.

If you don't, you're wasting your time on stuff that doesn't matter.

Here's the process I've created to find, interview, and manage great VA's after doing this for 5 years:

There's a lot of tasks you work on that are well below your intellectual capability.

Booking haircut appointments, ordering groceries, and finding flights is a waste of time.

First, you want to find out what tasks can you delegate.

Here's how:

Track everything you do every 15 minutes in a spreadsheet. Create 3 columns w/ the below questions

1. Do I like doing this?
2. Is it repeatable?
3. Can it be delegated?

If the answers are No, Yes, Yes -- you've found tasks to delegate!

We'll jump back into these tasks later.

Before we learn how to find them, let's understand the types of VA's:

1. Individual Freelancers (Low cost & High cost)
2. Agency VA's (High cost)

My experience has been with low-cost VA's (under $6/hour). I've gotten the same level of quality that I would with most US VA's.

Now, here's how we craft the right job post to attract the best ones: Be as specific as possible with what you expect. Here’s an example:

Also ask for a screenshot of their computer specs & internet speed results and a 2 min video of their background & why they want the job.