Reyben T. Cortes, Cyber Threat Team lead

About

Reyben Cortes is a Cyber Threat Intelligence Analyst. He is a National Cyber Scholar Semifinalist from 2023 from participating colleges/Universities nationwide, placing in the top 7% in the country. He has the GCIH, GSEC, and GICSP certifications, and in-pursuit of completing the B.S Applied Cybersecurity at SANS Technology Institute credited by the NSA as the top Cyber Academic Excellence. He is also a CR-ISAC member, a cyber civilian volunteer workforce focused on providing incident response services and support to SLTT - State, local, tribal, and territorial entities during a cyber attack. His impactful work has been mentioned in articles such as Cyberexpress, CheckPhish, and local news sources responding to a cyber attack.

He loves to track botnets, hacktivists, darkweb IAB sales, CVEs, APTs, OSINT malicious infrastructure domains, and shifting trends/tactics in the threat landscape. He has saved/warned many vulnerable/underresourced entities using attack surface management. I’ve helped tip/warn off 0-day vulnerabilities appliances from critical infrastructure entities including water sector, education, SLTT - State, Local, and Tribal governments before they get hacked by ransomware gangs such as CVE-2024-4404 Apache ActiveMQ from HelloKitty ransomware & nation-state actors, highlighting the one I’ve helped patch CVE-2023-35078 Ivanti EPMM from a Hydropower plant entity. Cyber threat intelligence shouldn’t just be about cluttered reactive reporting that happened days, weeks, or months ago, but importantly, being proactive and actionable! I’ve helped warn off IoFA - Indicators of Future Attacks of malicious addresses during the 2024 election that hit a state system hours later. I’m also one of the first to respond to the infamous attack on Muleshoe and Abernathy during CARR - Cyber Army of Russia discovering the surfaces that were exploited and have been tracking where they are targeting vulnerable RFB 003.008 single-layer authentication that belonged to thousands of rural local water treatment plants across the U.S. I was also involved in unraveling the more profound severity to Salt Typhoons breach on the telecommunications infrastructure after discovering the rerouting mass BGP U.S internet traffic from compromised Cisco routers back to a Hong Kong ASN.

Skills:

Linkedin: https://www.linkedin.com/in/reybencortes/

Credly & Badges:

https://www.credly.com/users/reyben-cortes

Roles

Feb 2025–Present

Current role

Cyber Threat Team lead

CR-ISAC - Civilian Reserve Information Sharing & Analysis Center

Remote, Part Time

Digital Forensics Incident ResponseCybercrime

★ Proactive Cyber Threat Intelligence Team Lead

Disseminated indicators of double encoded Base-64 PowerShell commands in HTML from over 1000+ ClickFix domains | Identified 28+ Energy utilities, 14+ SLTT – State, Local, and tribal governments, and 23+ K-12/schools infected with the Eleven11 botnet | Presented a vulnerability report to the team from Sungrow about hardcoded credentials from 23,000+ PV-inverters vulnerable to psw111 default password as an OEM user |Decrypted malicious Base-64 encoded Powershell commands and mapped malicious campaigns to the MITRE ATT&CK framework etc

Jun 2022–Present

Current role

Cybersecurity Analyst & Threat Intelligence

U.S. Department of Homeland Security (DHS), Office of Intelligence & Analysis, Cyber Intelligence Center

District of Columbia

National SecurityCybersecurityInformation Security AnalystCybercrimeCybersecurity Analyst

I was the daily Cyber threat briefer for the U.S Department of Homeland Security, Office of Intelligence & Analysis, Cyber Intelligence Center's live Bi-weekly Cyber Threat intel Teleconference attended by thousands of SLTT - State, Local, and Tribal governments, critical infrastructure entities, including FBI InfraGuard along with several CISA leaders.

I briefed various threat actor campaigns such as BlackBasta ransomware, disseminated 0-days and N-days that were being exploited in the wild such as CVE-2024-34362 MOVEit, ScreenConnect 1708-1709 using Shodan Dorks to 1,000+ attendees. Contributed to the analysis of Smartchain contracts exploited by North Korean APT43 Kimsuky in the DeFI sector. During the 2024 Election I provided IoFa - Indicators of Future Attacks through the CIN - Cyber Intelligence Network that hit a states election system hours later.

Disseminated FOUO, NDB's - Network Defense Bulletins which are actionable/timely IoC's and contextualized threat actor campaigns from APTs to Scattered Spider during MGM grand attack using BLUF - Bottom Line Up Front writing pulled from high-side and low-side.