Specializing in pen testing, red teaming, and Active SOC. We share our knowledge through blogs, webcasts, open-source tools, and Backdoors & Breaches game.
Joined May 2013
- Tweets12.8K
- Following2.4K
- Followers49.7K
- Likes11.2K
Pinned Tweet
BHIS | #InfoSec Webcast - Available Now!
Your 5 Year Plan into InfoSec
w/ @strandjs
Recorded: 8/9/2017
Watch: blackhillsinfosec.com/webcas…
Infosec news on Monday, AI research tips with Ashley Knowles on Wednesday, and a Free Lab Fridays webcast on Thursday. Watch live and join us on Discord!
events.zoom.us/eo/AqZceUFfoY…
The UK just announced new AI cybersecurity measures, and the early results are promising: two government pilots used frontier AI to find and address 1,000+ vulnerabilities, and remediation time dropped from 50 days to eight.
We weighed in for The IT Nerd. The initiative looks great, but the big question is how fast it can scale:
“Laws and implementation can take a long time, even after successful pilot programs.”
NEW BHIS | Blog
Drowning in alerts that don’t matter? Learn how detection engineering turns raw logs and telemetry into detections your analysts can actually trust... and how to balance precision and recall so real threats don’t slip through.
Detection Engineering: Stop Drowning in Alerts and Start Catching Bad Guys
by: Wade Wells
Published: [10/22/2026]
Learn more: [blackhillsinfosec.com/detect…
BHIS is heading to San Antonio for the Texas Bankers Association Annual Security & Risk Management Conference, Nov 18–20 at The Westin Riverwalk.
If you’re attending, come find us and say hi! We’d love to talk shop about security, risk, and keeping financial institutions one step ahead.
Half machine, half seasoned pentester, all bad news for attackers! Fusion PenTest pairs a purpose built AI with a senior BHIS tester, so you get the speed of automation and someone who knows the difference between a real problem and a false alarm.
blackhillsinfosec.com/fusion…
Your attack surface changes every day. New subdomains, forgotten cloud assets, and shadow IT appear faster than a once-a-quarter scan can catch them.
Join us for a free webcast on turning recon from a one-off task into a continuous process, so you see what attackers see, when they see it!
events.zoom.us/ev/AslruhvVE_…
Nearly 20 million people may have had their health data exposed in the 2025 breach of Oracle Health’s legacy Cerner servers, which hadn’t yet been migrated after Oracle acquired the company.
We weighed in for The HIPAA Journal on why “legacy systems” isn’t an excuse:
“Security due diligence absolutely needs to be part of the mergers and acquisitions process.”
Read the full article: hipaajournal.com/oracle-heal…
Thanks to everyone who stopped by the Black Hills Information Security booth at Wild West Hackin’ Fest! 🤠🖤 We loved catching up with familiar faces, meeting new ones, and watching the sticker piles disappear.
Until next time, stay curious and keep hacking!
New week, new things to learn! Kick off Monday with Talkin’ About [Infosec] News, get into containers and AI sandboxing with Jay Beale on Wednesday, then swing by Thursday’s BHIS Webcast to say hi. See you there!
events.zoom.us/eo/AqZceUFfoY…
The FBI and Secret Service say the FortiBleed campaign has compromised 86,000+ Fortinet devices across 194 countries, and attackers are selling that access to other threat actors.
We weighed in for The IT Nerd on why this is more APT than smash-and-grab ransomware:
“I’m terrified of the attacker who wants to quietly live inside that organization.”
itnerd.blog/2026/10/07/fbi-s…
We found a translator extension that changed hands via a lapsed domain and spent 99 days reporting every URL a finance user visited. Endpoint controls stayed clean. Still live, installs climbing.
activesoc.blackhillsinfosec.…
**NEW** BHIS | Blog
Ever finish a threat hunt and come up empty? Here’s why finding nothing isn’t failure. It’s validation, and it might reveal a detection you thought you had... but don’t
The Threat Hunting Flywheel: Why Threat Hunting Isn’t About Finding Bad Things
by Faan Rossouw
Published: 10/14/2026
Learn more: blackhillsinfosec.com/threat…
There’s a difference between knowing the framework and knowing how attackers laugh at it. Our GRC team comes from the same crew that runs pentests, red teams, and incident response, so when we tell you a control matters, it’s because we’ve watched what happens when it doesn’t.
blackhillsinfosec.com/grc/
We worked a ClickFix chain where every hop before the payload was google.com or openai.com. The final host wasn't a domain or an IP: it was pasted as 2549127135, a decimal integer most URL-matching never checks.
activesoc.blackhillsinfosec.…
The easiest system to hack? A human. Join Dorota Kozłowska for Mind Games: How to Hack a Human Being, a FREE 1-hour webcast on rapport, micro-expressions, and how social engineers turn everyday conversations into access.
events.zoom.us/ev/AnFa4uSI2v…
A validly signed pythonw.exe we caught ran with zero arguments: its payload sat in a path configuration file Python reads at startup, invisible to any command-line rule. Least privilege stopped ScreenConnect it carried.
activesoc.blackhillsinfosec.…
Pennington County, SD was hit by ransomware on July 4. Now they’re rebuilding from the ground up and sharing lessons with other local governments. John Strand weighs in on who’s likely behind this summer’s attacks.
nationalcybersecurity.com/le…
Fusion PenTest is our external network pentest that pairs a purpose-built AI system with nearly 20 years of BHIS hands-on testing. The AI maps your internet-facing attack surface and connects the dots across thousands of data points. Then a senior BHIS tester validates the findings that matter before anything reaches your desk.
You get a clear, actionable report with a plain-language executive summary, evidence for every finding, and remediation steps tailored to your environment.
blackhillsinfosec.com/fusion…
The Spearphish General Store is officially OPEN at Wild West Hackin' Fest! Come get phished (responsibly) 😉
