# Eric Taylor

Eric Taylor researches ransomware and other cyber threats, publishing detailed threat-actor profiles with intrusion methods, indicators of compromise, detection guidance, and practical security steps.

- Profile: https://b2binfluencer.marketing/creators/eric-taylor/
- LinkedIn: https://www.linkedin.com/in/ransomware
- Median of last 9 posts: 12 reactions, 3 comments (checked 2026-11-02)
- Topics: vulnerability-management, incident-response, threat-intelligence, ransomware
- Based on 8 dated posts, latest 2026-10-09

## Summary

Eric Taylor is most useful for grounded threat-actor research and practical defender context.

- Best for: Threat-intelligence or incident-response vendors wanting a technical webinar built from Eric Taylor's own research.
- Not for: Security-awareness training or consumer tech brands seeking sponsored keynotes or product endorsements.
- Check first: Ask for LinkedIn follower analytics, comparable session results, and commercial terms.

### Takeaways

- Verify a threat actor's claims instead of amplifying them.
- Patch the exposed appliance and the old CVE first.
- Consolidate scattered vendor reporting into one defender document.

## Main ideas

- **Verify a threat actor's claims instead of amplifying them**: Eric Taylor's most consistent stance is that a group's marketing is not evidence. The method is to read the tools being sold, check the claimed victims against what is publicly checkable, and state the result plainly, including when it makes the attacker look weaker than advertised. This is presented as a service to defenders: knowing that a ransomware strain is breakable changes a victim's options.
- **Patch the exposed appliance and the old CVE first**: A recurring priority is prioritization rather than alarm. Eric Taylor repeatedly narrows the question to which vulnerabilities deserve attention now and what to close first, then supplies a short numbered list. Edge devices, virtualization, and backup infrastructure come up as the systems worth checking, and old vulnerabilities remain relevant because they are still being probed.
- **Consolidate scattered vendor reporting into one defender document**: The signature output is a single profile that gathers what several security vendors have already published, organizes it into one intrusion narrative, and attaches the operational material a defender needs: a stage-by-stage walkthrough, a numbered patch list, a MITRE ATT&CK mapping, indicators with hunting guidance, and a containment plan. The argument behind the format is that defenders are busy and should not have to assemble the picture from five separate reports.
- **Say when a claim is unproven rather than repeat the headline**: When the evidence is thin, the posts say so and leave the question open. This comes through in two ways: an extortion claim assessed against the attacker's own deadline and the target's public silence, and a release-day exploit described as part of a wider pattern rather than as a one-off event. Eric Taylor attributes claims to the groups making them instead of restating them as fact.
- **Threats directed at Eric Taylor are treated as concrete, not rhetorical**: One post sits outside the research work and shows a boundary rather than an argument. It is a short reply thanking another person, Ranuja Randira, and stating that a claim about wanting Eric Taylor assassinated is not the first in a month, adding that roughly two weeks earlier someone from TN drove to their main office with plans to act on it. The claim about the assassination wish comes from others; the post is Eric Taylor's response to it. Read it as context on the person, not as threat research.

## Work to read

- [The Gentlemen (Storm-2697): full threat-actor profile](https://www.linkedin.com/posts/ransomware_ransomware-threatintel-dfir-activity-7511078431846223872-7i2h)
- [Blacknet-00: reviewing the tools instead of trusting the sales pitch](https://www.linkedin.com/posts/ransomware_ransomware-threatintel-dfir-activity-7513614388671553536-zDzd)
- [Testing an extortion claim instead of repeating it](https://www.linkedin.com/posts/ransomware_on-october-20-a-tg-channel-claiming-the-activity-7520549771581833216-5yRR)
- [Flagging an unpatched Windows Print Spooler flaw](https://www.linkedin.com/posts/ransomware_windows-print-spooler-heap-overflow-in-form-activity-7521172207918796800-OS4_)

## Partnerships

No partnership, sponsorship, or commercial-collaboration formats are documented in the material reviewed for Eric Taylor. The available posts are threat research and security commentary: threat-actor profiles, vulnerability write-ups, and short observations on industry incidents. None carries a sponsor disclosure, a media kit, rate information, or an official inquiry route for partnership discussions. A buyer planning a sponsored placement or paid collaboration with Taylor should treat the commercial terms as an open question and confirm them directly with Taylor before budgeting, rather than assuming ad or sponsorship inventory exists. If a future inquiry establishes a formal offer, this section should be revised with the documented format, its requirements, and the verified contact route.

## Alternatives

- Patrick Garrity: Choose Garrity when the vendor's webinar is tied to a breaking vulnerability or an exploitation-in-the-wild alert and the goal is a fast, current briefing that drives a remediation or sign-up action. The two available posts are short, dated alerts: 26 exploits released by the VulnCheck initial access team with detection artifacts, a warning about possible Citrix NetScaler zero-days, and observed exploitation of Rejetto HFS and HFS2 using two different CVEs, closing with a link to free exploitation alerts.
- Phil Tonkin: Choose Tonkin when the audience is operational technology and critical-infrastructure security rather than general threat intelligence. The available posts stay on OT ground: an investigation into commercial AI tools used to identify an internally accessible SCADA/IIoT management interface at Mexican government organisations, three priorities for governments and operators (visibility across the operational environment, less exposure between enterprise and operational systems, and response plans built for industrial realities), and a speaking slot at the techUK OT Security Conference.
- Omar Ahmed: Choose Ahmed when the vendor wants a speaker already comfortable with product-led content and a direct call to action. One available post is a detailed Telegram Desktop vulnerability teardown (CVE-2026-107181, CVSS 8.6, an IPC record-separator flaw, account takeover conditions, and the fix commit and version) that ends by inviting discussion. The other reviews the FBI's Operation Blackout scam-center disruption, notes missing malware names, phishing domains, crypto addresses and IOCs, and closes with a SOC hardening message and a direct ANYRUN sandbox product call to action.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/