Today's issue includes events affecting Austalia, Canada, China, European Union, Iran, Ireland, Israel, NATO/OTAN, New Zealand, Russia, Saudi Arabia, United Kingdom, United States, and and Vietnam.

Bring your own context.

When threat phenomenology becomes threat metaphysics.

"I think we make one big ontological reorganization, or - I won't say discovery, but we essentially decided that what GOSSIPGIRL would mean to us was what we would begin to call a 'Supra Threat Actor.' Not to get too in the weeds of threat intelligence methodology and things that people might find to be too inside baseball, [but] essentially, in threat intelligence we tend to focus on threat actors - the idea that there is a cluster of activity that we can associate with a single entity, whether that's a criminal organization, or maybe an intelligence institution, or a group of mercenaries. Just a single organization. There's a deficiency there as we start to do more complex research, which is, what happens when we start to find different threat actors playing together? What happens when you see several independent threat actors with their own storied past, and their own malware platforms, and their own TTPs, their own ways of acting, clearly coming together for a common goal? We're not talking about somebody stealing somebody else's source code, or reusing open-source tools, or things like that that might get folks confused. We're talking about very complex platforms obviously being leveraged to play along."

—Juan Andres Guerrero-Saade, of Chronicle, discussing his team's work on the CyberWire's Research Saturday, 5.25.19.

Because the name of the threat can be "Legion," and because what they do is arguably more interesting than who they are.