// about
Austin Larsen
Principal Threat Analyst
Google Threat Intelligence Group
Bio
Austin Larsen is a threat intelligence investigator focused on the intrusions that make headlines. He is a Principal Threat Analyst with Google Threat Intelligence Group (GTIG), where he leads the response to its most significant cyber events, and previously worked in incident response at Mandiant.
He led the investigation into UNC5537's Snowflake campaign, which ended in the actor's arrest and a 2026 guilty plea, and was primary author on the research attributing the Barracuda ESG zero-day to UNC4841, which drew a public response from the Chinese government and was cited in a report to Congress. More recently he has coordinated GTIG's response to the Axios and TeamPCP supply chain attacks. He was named to the CyberScoop50 in 2025.
Much of his work comes down to the people on the other end of an attack. He has coordinated more than 1,000 notifications to affected organizations, and increasingly focuses on how adversaries misuse AI and how AI can help find and warn victims faster.