TreyCraf7 @TCraf7

Adversary emulation @scythe_io. Public Speaker. USMC vet. Writing about threat intel, detection engineering, and what actually works. Thoughts are my own. Tampa, FL Joined July 2018

Tweets

1K
Followers

574
Following

1K
Likes

3K

SCYTHE @scythe_io

6 hours ago

The choreography gets the headlines. The entry point is password spraying. Rob Joyce (@RGB_Lights), Owner at Joyce Cyber and former Cybersecurity Director at the NSA and Trey Bilbrey (@TCraf7) on Iran's hack-and-leak playbook. The mundane stuff is what gets them in. See more of our upcoming live sessions: hubs.ly/Q04jvh4N0 #ThreatEmulation

0 3 2 113 0

View Details

TreyCraf7 @TCraf7

a week ago

Got some new coffee in the mix. Its definitely worth a try if you’re into unique coffee.

0 0 0 71 0

View Details

TreyCraf7 @TCraf7

2 weeks ago

Huge thank you to everyone who came out to @BSidesTampa this weekend. I had an absolute blast delivering both a hands-on workshop with my good buddy Tyler Casey and the opening keynote! The conversations, questions, and energy from the community were incredible. Really appreciate everyone who spent part of their weekend volunteering, sharing ideas, and talking shop with us. Looking forward to the next one.

0 0 1 37 0

View Details

SCYTHE @scythe_io

2 weeks ago

Four SCYTHE sessions live in June. Bring your questions. 📅 June 5 | 1 PM ET - Train Like You Fight Bryson Bort (@brysonbort) + Snehal Antani (@snehalantani) on the wartime mindset for modern defenders. hubs.ly/Q04gXTM90 📅 June 11 | 12 PM ET -- Protected Data Exfiltration Tyler Casey + Trey Bilbrey (@TCraf7) on moving sensitive data past controls, and what catches it. hubs.ly/Q04gXWPj0 📅 June 25 | 12 PM ET -- ChillyHell macOS Backdoor Bilbrey, Pemberton, Casey on macOS backdoor behavior + detection coverage that actually holds. hubs.ly/Q04gXP4d0 📅 June 30 | 3:50 PM ET -- Oops, That Was AI Bryson Bort (@brysonbort) + Erich Kron (@ErichKron) on AI-augmented social engineering, defender side. hubs.ly/Q04gX-Lb0 If you've only read about these, come watch them run. hubs.ly/Q04gXT8M0 #ThreatEmulation

0 3 4 237 0

View Details

SCYTHE @scythe_io

4 weeks ago

Tomorrow, May 7 at 3:00 PM ET, @brysonbort sits down with Rob Joyce (@RGB_Lights), Owner at Joyce Cyber and former Cybersecurity Director at the NSA, and Trey Bilbrey (@TCraf7) for Threat Brief LIVE: Iran, Hot TTPs and State of the Threat 🦄 They'll cover Iran's current cyber posture, the active groups worth tracking, recent hits on prominent organizations, and what specific exposure looks like for US companies and critical infrastructure operators. Register here: hubs.ly/Q04fn-vd0 #ThreatEmulation #ICSecurity

0 3 3 282 0

View Details

Bryson 🦄 @brysonbort

a month ago

Alex leads Cyber research at Southern Company - he shares how he's tested electric substation security. 🦄⚡

SCYTHE @scythe_io

a month ago

Lateral movement into OT often starts with documentation that's already accessible from the DMZ. At #UniCon2026, Alexander Waitkus (@SouthernCompany) breaks down how adversaries pivot across zones and map your OT environment from the inside. #ThreatEmulation #OTSecurity

0 2 10 5K 7

0 2 21 4K 8

View Details

Bryson 🦄 @brysonbort

a month ago

Seeing a lot of AI in your network? All traffic provides the ocean for hackers to swim in your network and blend into the waves. They are there, you’re just not seeing them. Notepad++ is the software that got the headlines, but it was AI usage it abused. 1/7

1 2 8 920 1

View Details

Bryson 🦄 @brysonbort

a month ago

LIVE now with @infosec_fox on #Unicorndispatchlive. 🦄🎙️

0 1 4 279 1

View Details

TreyCraf7 @TCraf7

a month ago

I made a cool infographic to describe the PTEF (github.com/scythe-io/purp… ) and what it provides. Thought it would be nice to put out there for those interested in getting into Purple Teaming. Its also worth giving it gander if your thinking about how you can start updating and testing against the new MITRE ATT&CK update to v19 (attack.mitre.org/resources/upda… ). # PurpleTeaming #Infosec

0 2 5 462 2

View Details

TreyCraf7 @TCraf7

a month ago

So here’s the real question: Have you tested yours lately? I'm curious where other teams are leaning.. If you had to pick right now: What Are you more worried about right now? A) Supply chain compromise B) Missed exploitation C) The magical AI overlords doing all the things.. 🧵 (8/8)

0 2 2 209 1

View Details

TreyCraf7 @TCraf7

a month ago

The best teams don’t just blindly trust their detections. They test them. Frequently. (BTW) My good buddy Tyler did a presentation during @scythe_io #Unicon2026 on this very thing a little while back that is worth checking out: youtu.be/LEKZYbfDtPY?si… 🧵 (7/8)

1 1 2 69 0

View Details

TreyCraf7 @TCraf7

a month ago

Patch fast and risk a supply chain compromise. OR Patch slow and leave the door open for exploitation. That’s the reality right now and here’s no clean answer. 🧵 (1/8) #BlueTeam #CyberSecurity #CyberThreats

1 1 2 63 0

View Details

TreyCraf7 @TCraf7

a month ago

@medsci_yb3r @thor_scanner @UAlberta @AHS_media @Bitdefender Thats wild! Interesting catch.

0 0 1 22 0

View Details

Filipi Pires @FilipiPires

a month ago

Hey guys.. If you missed my presentation on @RedTeamVillage_ at @defcon 33 last year!.. That is your opportunity!!.. We had a great event called RTV Overflow..and I did the same presentation to you guys!.. Check the link in the comment below..and I hope to see at DEF CON 33 this year!.. #RTV #redteamVillage #offensivesecurity #DEFCON33 #redteam #redteamVillage #Malwareexploitation #pdfmalicious

1 3 11 736 2

View Details

SCYTHE @scythe_io

a month ago

Iranian threat actors are active and their tooling is showing up in campaigns against US critical infrastructure right now. On May 7th at 3PM ET, Bryson Bort (@brysonbort) sits down with Rob Joyce (@RGB_Lights), Owner at Joyce Cyber and former Cybersecurity Director at the NSA, and Trey Bilbrey (@TCraf7) for the first-ever Threat Brief LIVE: Iran, Hot TTPs & State of the Threat. They'll break down Iran's current cyber posture, the active groups you should have on your radar, recent hits on prominent organizations, and what specific exposure looks like for US companies and critical infrastructure operators. Register here: hubs.ly/Q04dGYdC0 #ThreatBriefLIVE #ThreatEmulation #ThreatIntelligence