Sign In

Charles Carmakal

CTO and Board Advisor

Charles Carmakal is a prominent figure in the field of cybersecurity and serves as a part-time Lecturer at Columbia University's School of International and Public Affairs (SIPA). He specializes in International Security Policy, focusing on areas such as cybersecurity and risk management.13

Professional Background

Carmakal is currently the Chief Technology Officer (CTO) of Mandiant Consulting, a division of Google Cloud. In this role, he leads a team that responds to significant security incidents, including high-profile breaches like the SolarWinds attack and the Colonial Pipeline disruption. With over 20 years of experience, he has worked extensively with Fortune 500 companies to enhance their cybersecurity resilience.12

He has also provided strategic security guidance to executive leadership and boards, emphasizing the importance of robust security frameworks in combating advanced cyber threats. His expertise has made him a sought-after speaker and consultant, having testified before Congress on various cybersecurity issues and frequently appearing in major media outlets.12

Education

Carmakal holds both Bachelor’s and Master’s degrees in Decision and Information Sciences from the University of Florida.12

Contributions to Academia

As a lecturer at Columbia University, he contributes to shaping the next generation of leaders in international security policy, particularly in understanding the complexities of cybersecurity in global contexts.34 His involvement in academia complements his extensive practical experience, bridging theoretical knowledge with real-world applications.

Online Presence

For more information about his professional journey and insights into cybersecurity, you can visit his LinkedIn profile here.5

Highlights

Aug 14 · linkedin

🚨 Google's Threat Analysis Group (TAG) has observed APT42, an espionage actor associated with Iran’s Islamic Revolutionary Guard Corps (IRGC), targeting several individuals associated with the U.S. presidential elections. 🚨   Earlier this year, APT42 targeted the personal email accounts of approximately a dozen individuals affiliated with President Biden and with former President Trump, including current and former officials in the U.S. government and individuals associated with the respective campaigns. TAG continues to observe unsuccessful attempts from APT42 to compromise the personal accounts of individuals affiliated with President Biden, Vice President Harris, and former President Trump, including current and former government officials and individuals associated with the campaigns.   As we get closer to the U.S. presidential elections, it’s important to stay vigilant and be aware of potential increased adversarial cyber activity.   Here are some learnings from dealing with APT42 over the years:   ☣️ APT42 is proficient at social engineering. While they may send emails with malicious content when first contacting their targets, they often send malicious payloads only after engaging in long conversations with their targets, which may occur over several days. ☣️ Sometimes they initiate discussions over email, then ask their targets to switch to another platform, like WhatsApp, Signal, Telegram, or other platforms, where they deliver malicious content (often links to credential harvesting websites). This allows APT42 to avoid malicious content inspection/antivirus which is common with email providers. ☣️ Sometimes APT42 initiate their communications with their ultimate targets by using the real, but compromised, email accounts or websites of prominent individuals or organizations. ☣️ APT42 sometimes convinces their targets to join video calls (which lends credence to identities that APT42 is impersonating). Targets are presented with credential harvesting phishing pages asking them to log into the video calling platform. ☣️ Not all email attachments contain malware – sometimes they are used simply to entice users to visit credential harvesting sites.   Individuals impacted by APT42 should check for newly added recovery email addresses and phone numbers, new application specific passwords, email forwarding, new passkeys, new third-party connected applications, and other unauthorized changes to their email accounts. They should also reset their backup codes.   Read the blog for more details: https://lnkd.in/ev7BW2t5

Jul 18 · linkedin

Mandiant (part of Google Cloud) and Google Threat Analysis Group (TAG) just published research on a multi-year threat campaign conducted by APT41, a China-nexus threat actor that conducts intrusions for the PRC and personal financial gain.

Here are the highlights of our findings:

1️⃣ APT41 targeted and compromised multiple organizations operating within the global shipping and logistics, media and entertainment, technology, and automotive sectors since early 2023. Mandiant has notified the impacted organizations. 2️⃣ The majority of organizations were operating in Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom. 3️⃣ We identified several new malware families that APT41 deployed and leveraged in victim environments.

The blog includes plenty of IOCs and detections to help network defenders.

Excellent research by Mike Stokkel, Pierre Gerlings, Renato Fontana, Luis Rocha, Jared Wilson, Stephen Eckels, and Jonathan L..

Link to blog: https://lnkd.in/ev9f97xT

Related Questions

What courses does Charles Carmakal teach at Columbia University?
How did Charles Carmakal transition from PwC to Mandiant?
What are some of the most impactful security breaches Charles Carmakal has responded to?
How does Charles Carmakal's experience at Mandiant influence his teaching at Columbia?
What are Charles Carmakal's main responsibilities as the CTO of Mandiant?
Charles Carmakal
Charles Carmakal, photo 1
Charles Carmakal, photo 2
Add to my network

Location

New Alexandria, Virginia, United States