Research Saturday

The spy who logged me in.

Sat, 09 May 2026 05:00:00 -0000

Mark Kelly, Staff Threat Researcher at Proofpoint, is discussing their work on "I’d come running back to EU again: TA416 resumes European government espionage campaigns." China-linked threat group TA416 has resumed large-scale phishing and malware campaigns targeting European governments, diplomatic missions tied to the EU and NATO, and more recently Middle Eastern entities following the outbreak of conflict in Iran.

The group has continually evolved its tactics between mid-2025 and early 2026, using techniques like fake Cloudflare verification pages, Microsoft OAuth redirect abuse, and malicious C# project files to deliver customized PlugX malware through spearphishing campaigns. Researchers say the renewed activity reflects shifting geopolitical priorities tied to EU-China tensions, the Russia-Ukraine war, and instability in the Middle East, while highlighting TA416’s ongoing focus on intelligence gathering against diplomatic networks.

The research and executive brief can be found here:

I’d come running back to EU again: TA416 resumes European government espionage campaigns

Learn more about your ad choices. Visit megaphone.fm/adchoices

Double-edged threat.

Sat, 02 May 2026 05:00:00 -0000

Today we are joined by Justin Albrecht, Principal Researcher at Lookout, discussing "Attackers Wielding DarkSword Threaten iOS Users." DarkSword is a highly sophisticated iOS exploit chain discovered by Lookout that targets iPhones (iOS 18.4–18.6.2), enabling near zero-click compromise and rapid theft of sensitive data, including credentials and cryptocurrency wallet information.

Likely deployed by a Russia-linked threat actor (UNC6353) against Ukrainian users, it uses watering hole attacks on compromised websites and operates in a “hit-and-run” fashion—exfiltrating data within minutes before wiping traces. The campaign highlights a growing secondary market for advanced exploits, allowing financially motivated groups to access powerful tools once reserved for state actors, significantly expanding the mobile threat landscape.

The research and executive brief can be found here:

⁠Attackers Wielding DarkSword Threaten iOS Users

Learn more about your ad choices. Visit megaphone.fm/adchoices

A QRazy clever scam.

Sat, 25 Apr 2026 05:00:00 -0000

This week, we are joined by Juliana Testa, Senior Security Engineer from 7AI, sharing their work on "Quish Splash - When the QR Code Is the Weapon: A Multi-Wave Phishing Campaign That Slipped Past Every Filter." A large-scale “quishing” campaign used QR codes embedded in image attachments to hide phishing URLs, allowing 28 out of 33 emails to bypass SPF, DKIM, DMARC, and Microsoft Defender and land directly in inboxes.

Each recipient received a unique QR code and tracking ID, defeating traditional detection methods and enabling attackers to scale the campaign to over 1.6 million emails across multiple organizations while shifting execution to less-secure mobile devices. The attack was ultimately uncovered through AI-driven alerting combined with human analysis and threat hunting, highlighting a major blind spot in email security and the need for QR code inspection, mobile protections, and tighter auto-reply controls.

The research and executive brief can be found here:

Quish Splash - When the QR Code Is the Weapon: A Multi-Wave Phishing Campaign That Slipped Past Every Filter.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A new breed of RAT.

Sat, 18 Apr 2026 05:00:00 -0000

Today we are joined by Dr. Darren Williams, Founder and CEO of BlackFog, to discuss his team's work on "Steaelite RAT Enables Double Extortion Attacks from a Single Panel." A new remote access trojan, Steaelite, is being marketed on underground forums as an all-in-one platform that combines remote access, credential theft, surveillance, and ransomware deployment through a single browser-based dashboard.

Unlike traditional cybercrime toolchains, it merges data exfiltration and ransomware capabilities into one interface, with automated credential harvesting beginning as soon as a victim is infected. The tool signals a growing shift toward streamlined “double extortion” attacks, where data theft and encryption happen within the same system—raising the stakes for defenders to stop threats before data is exfiltrated.

The research and executive brief can be found here:

Steaelite RAT Enables Double Extortion Attacks from a Single Panel

Learn more about your ad choices. Visit megaphone.fm/adchoices

A wolf in admin clothing.

Sat, 11 Apr 2026 05:00:00 -0000

Today we are joined by Selena Larson, Threat Researcher from Proofpoint research team and co-host of Only Malware in the Building, talking about their work on "(Don't) TrustConnect: It's a RAT in an RMM hat." Proofpoint uncovered TrustConnect, a malware-as-a-service platform posing as a legitimate remote monitoring and management (RMM) tool, but actually functioning as a remote access trojan (RAT) sold to cybercriminals for $300/month.

The operation used a fake business website, legitimate-looking certificates, and branded installers (like fake Microsoft Teams or Zoom apps) to trick victims, while providing attackers with full remote control, file transfer, and surveillance capabilities. Although parts of its infrastructure were disrupted, the threat actor quickly rebounded with new variants, highlighting both the resilience of the operation and its deep ties to the broader cybercriminal ecosystem abusing RMM tools.

The research and executive brief can be found here:

(Don't) TrustConnect: It's a RAT in an RMM hat

Learn more about your ad choices. Visit megaphone.fm/adchoices

Startup surge sparks spy interest.

Sat, 04 Apr 2026 05:00:00 -0000

This week, we are joined by Santiago Pontiroli, Threat Intelligence Research Lead from Acronis TRU team, discussing their work on "New year, new sector: Transparent Tribe targets India’s startup ecosystem." The Acronis Threat Research Unit uncovered a new campaign by Transparent Tribe showing the group has expanded beyond traditional government and defense targets to India’s startup ecosystem, especially cybersecurity and OSINT-focused firms.

The attackers use startup-themed lures delivered via ISO files and malicious shortcuts to deploy Crimson RAT, a highly obfuscated tool capable of surveillance, data theft, and system control. Despite this shift, the campaign closely mirrors the group’s long-standing espionage tactics, suggesting startups are being targeted for their connections to government, law enforcement, and sensitive intelligence networks.

The research and executive brief can be found here:

New year, new sector: Transparent Tribe targets India’s startup ecosystem

Learn more about your ad choices. Visit megaphone.fm/adchoices

When “safe” documents aren’t.

Sat, 28 Mar 2026 05:00:00 -0000

Omer Ninburg, CTO of Novee Security, joins us on this episode of Research Saturday to discuss their work on "From PDF to Pwn: Scalable 0day Discovery in PDF Engines and Services Using Multi-Agent LLMs." Historically, Portable Document Formats – the immutable, localized PDF – was once considered a “safe” component inside enterprise environments. That is no longer the case.

To demonstrate how PDF services and engines can be exploited, the team at Novee used their proprietary, multi-agent LLM system to uncover vulnerability patterns, and systematically scale them into a broad discovery campaign across two PDF vendor ecosystems.

The research uncovered 16 verified vulnerabilities across client-side PDF viewers, embedded plugins, and server-side PDF services.

The research and executive brief can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

A subtle flaw, a massive blast radius.

Sat, 21 Mar 2026 05:00:00 -0000

Yuval Avrahami from Wiz joins to share their work on "CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild." Wiz Research uncovered “CodeBreach,” a critical supply chain vulnerability caused by a subtle misconfiguration in AWS CodeBuild pipelines that allowed attackers to take over key GitHub repositories, including the widely used AWS JavaScript SDK that powers the AWS Console.

By exploiting an unanchored regex filter, unauthenticated attackers could trigger privileged builds, steal credentials, and potentially inject malicious code into software used across a majority of cloud environments. AWS has since remediated the issue and introduced stronger safeguards, but the incident highlights a growing trend of attackers targeting CI/CD pipelines where small misconfigurations can lead to massive downstream impact.

The research can be found here:

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Learn more about your ad choices. Visit megaphone.fm/adchoices

Your AI sidekick might be a spy.

Sat, 14 Mar 2026 05:00:00 -0000

This week, we are joined by Or Eshed, Co-Founder and CEO from LayerX Security, discussing their work on "How We Discovered A Campaign of 16 Malicious Extensions Built to Steal ChatGPT Accounts." Researchers uncovered a coordinated campaign of 16 malicious browser extensions posing as ChatGPT productivity tools while secretly stealing user accounts.

The extensions intercept ChatGPT session authentication tokens and send them to attacker-controlled servers, allowing threat actors to impersonate users and access their conversations, files, and connected services like Google Drive or Slack. The findings highlight how AI-focused browser extensions are creating a new attack surface, emphasizing the need for organizations to closely monitor and restrict third-party AI tools.

The research can be found here:

⁠⁠⁠How We Discovered A Campaign of 16 Malicious Extensions Built to Steal ChatGPT Accounts

Learn more about your ad choices. Visit megaphone.fm/adchoices

The scareware rabbit hole.

Sat, 07 Mar 2026 06:00:00 -0000

This week we are joined by Marcelle Lee, cybersecurity consultant and researcher, discussing "CTI tradecraft: Investigating a mobile scareware campaign." She details how a routine click on a Google News story led to a mobile scareware pop-up—and a deeper investigation into a broader campaign.

Using free tools like Censys, URLScan, VirusTotal, and CyberChef, she pivoted from two domains to uncover more than 100 related domains, shared infrastructure, and links to questionable antivirus apps in the Google Play Store. The findings are mapped to the MITRE ATT&CK framework, showing how freely available resources can power meaningful, actionable threat intelligence.

The research can be found here:

⁠CTI tradecraft: Investigating a mobile scareware campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

The parking lot of digital danger.

Sat, 28 Feb 2026 06:00:00 -0000

This week we are joined by Dr. Renée Burton, Vice President of Infoblox Threat Intel, discussing "Parked Domains and Direct Search: An Underreported Security Risk." Parked domains are no longer harmless ad pages — new research finds that in today’s “direct search” or zero-click parking ecosystem, more than 90% of visits to certain parked lookalike domains lead to scams, malware, or deceptive content, often hidden behind layers of traffic distribution systems and device fingerprinting.

The report details three previously unpublished domain portfolio actors who weaponize typosquatting, DNS manipulation — including rare “double fast flux” techniques highlighted in a 2025 advisory from Cybersecurity and Infrastructure Security Agency — and even misconfigured name server records to evade detection and funnel real users toward malicious advertisers. Beyond malvertising, some parked lookalike domains collect misdirected email, fuel business email compromise, and exploit outdated links — including those surfaced by generative AI — underscoring how a simple typo can expose users and enterprises to significant risk.

The research can be found here:

Parked Domains Become Weapons with Direct Search Advertising

Learn more about your ad choices. Visit megaphone.fm/adchoices

Telegram for the throne.

Sat, 21 Feb 2026 06:00:00 -0000

Today we have Tomer Bar, VP of Security Research at SafeBreach Labs, discussing their work on "Prince of Persia: A Decade of Iranian Nation-State APT Campaign Activity under the Microscope". In this first installment of SafeBreach’s deep dive into the Iranian-linked APT known as “Prince of Persia,” originally exposed by Palo Alto Networks Unit 42, researchers reveal that the group never truly went dark after 2022—but instead evolved.

Led by Tomer, the investigation uncovers new variants of Foudre and Tonnerre malware, expanded campaign scale, active C2 infrastructure through late 2025, and a shift toward Telegram-based command-and-control. The research provides rare, sustained visibility into nearly a decade of Iranian nation-state cyber operations, offering fresh indicators of compromise and insight into how the group continues to refine its tooling, obfuscation, and targeting.

The research can be found here:

Prince of Persia, Part 1: A Decade of Iranian Nation-State APT Campaign Activity under the Microscope

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stealer in the status bar.

Sat, 14 Feb 2026 06:00:00 -0000

Today we have Ziv Mador, VP of Security Research from LevelBlue SpiderLabs discussing their work on "SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp." Researchers at LevelBlue SpiderLabs have identified a new Brazilian banking Trojan dubbed Eternidade Stealer, spread through WhatsApp hijacking and social engineering campaigns that use a Python-based worm to steal contacts and distribute malicious MSI installers.

The Delphi-compiled malware targets Brazilian victims, profiles infected systems, dynamically retrieves its command-and-control server via IMAP email, and deploys banking overlays to harvest credentials from financial institutions and cryptocurrency platforms. The campaign reflects the continued evolution of Brazil’s cybercrime ecosystem, combining WhatsApp propagation, geofencing, encrypted C2 communications, and process injection to maintain stealth and persistence.

The research can be found here:

SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp

Learn more about your ad choices. Visit megaphone.fm/adchoices

The phishing kit that thinks like a human.

Sat, 07 Feb 2026 06:00:00 -0000

Piotr Wojtyla, Head of Threat Intel and Platform at Abnormal AI, is discussing their work on "InboxPrime AI: New Phishing Kit Fueling Scalable, AI-Powered Cybercrime." A new AI-powered phishing kit called InboxPrime AI is rapidly gaining traction in underground forums, automating the creation and delivery of highly believable phishing emails that mimic legitimate business communications and leverage Gmail’s web interface to evade detection.

First spotted in October 2025, the kit combines AI-generated content, template variation, sender identity spoofing, and built-in spam checks to maximize inbox placement and dramatically lower the barrier to running large-scale phishing campaigns. Its shift to a one-time $1,000 purchase and growing user base underscore the industrialization of phishing and highlight how quickly AI-driven attack tools are outpacing legacy email defenses.

The research can be found here:

⁠⁠⁠InboxPrime AI: New Phishing Kit Fueling Scalable, AI-Powered Cybercrime

Learn more about your ad choices. Visit megaphone.fm/adchoices

The link knows all.

Sat, 31 Jan 2026 06:00:00 -0000

Muhammad Danish, University of New Mexico lead author and cybersecurity researcher, discussing his team's work on "Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs". This paper examines how the push for frictionless user experiences has led many services to rely on SMS-delivered, single-click URLs—an inherently insecure channel that can be intercepted or leaked.

Analyzing more than 322,000 unique URLs from 33 million messages, the researchers found widespread security failures, including exposed PII across 701 endpoints at 177 services due to weak, token-based authentication that treats possession of a link as sufficient authorization. The study also identified low-entropy tokens enabling mass URL enumeration and data overfetching issues, though disclosures prompted 18 services to fix flaws, improving privacy protections for at least 120 million users.

The research can be found here:

⁠Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs

Learn more about your ad choices. Visit megaphone.fm/adchoices

Caught in the funnel.

Sat, 24 Jan 2026 06:00:00 -0000

Today we have Andrew Northern, Principal Security Researcher at Censys, discussing "From Evasion to Evidence: Exploiting the Funneling Behavior of Injects". This research explains how modern web malware campaigns use multi-stage JavaScript injections, redirects, and fake CAPTCHAs to selectively deliver payloads and evade detection.

It shows that these attack chains rely on stable redirect and traffic-distribution chokepoints that can be monitored at scale. Using the SmartApe campaign as a case study, the report demonstrates how defenders can turn those chokepoints into high-confidence detection and tracking opportunities.

The research can be found here:

From Evasion to Evidence: Exploiting the Funneling Behavior of Injects

Learn more about your ad choices. Visit megaphone.fm/adchoices

Picture perfect deception.

Sat, 17 Jan 2026 06:00:00 -0000

Today we are joined by Ben Folland, Security Operations Analyst from Huntress, discussing their work on "ClickFix Gets Creative: Malware Buried in Images." This analysis covers a ClickFix campaign that uses fake human verification checks and a realistic Windows Update screen to trick users into manually running malicious commands.

The multi-stage attack chain leverages mshta.exe, PowerShell, and .NET loaders, ultimately delivering infostealers like LummaC2 and Rhadamanthys, with payloads hidden inside PNG images using steganography. While technically sophisticated, the campaign hinges on simple user interaction, underscoring the importance of user awareness and controls around command execution.

The research can be found here:

ClickFix Gets Creative: Malware Buried in Images

Learn more about your ad choices. Visit megaphone.fm/adchoices

Walking on EggStremes.

Sat, 10 Jan 2026 06:00:00 -0000

This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company." Built for long-term espionage, the campaign uses DLL sideloading, in-memory execution, and abused Windows services to stay stealthy and persistent.

We walk through how the multi-stage framework delivers a powerful backdoor with reconnaissance, lateral movement, data theft, and keylogging capabilities—and what this operation reveals about the evolving tactics defenders need to watch for.

The research can be found here:

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

Learn more about your ad choices. Visit megaphone.fm/adchoices

Don’t trust that app!

Sat, 03 Jan 2026 06:00:00 -0000

While our team is out on winter break, please enjoy this episode of Research Saturday.

Today we are joined by ⁠⁠Selena Larson⁠⁠, co-host of ⁠⁠Only Malware in the Building⁠⁠ and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at ⁠⁠Proofpoint⁠⁠, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon.

These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft’s upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks.

The research can be found here:

⁠⁠⁠⁠Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Learn more about your ad choices. Visit megaphone.fm/adchoices

Excel-lerating cyberattacks.

Sat, 27 Dec 2025 06:00:00 -0000

While our team is out on winter break, please enjoy this episode of Research Saturday.

This week, we are joined by ⁠Tom Hegel⁠, Principal Threat Researcher from ⁠SentinelLabs⁠ research team, to discuss their work on "Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition." The latest Ghostwriter campaign, linked to Belarusian government espionage, is actively targeting Ukrainian military and government entities as well as Belarusian opposition activists using weaponized Excel documents.

SentinelLabs identified new malware variants and tactics, including obfuscated VBA macros that deploy malware via DLL files, with payload delivery seemingly controlled based on a target’s location and system profile. The campaign, which began preparation in mid-2024 and became active by late 2024, appears to be an evolution of previous Ghostwriter operations, combining disinformation with cyberattacks to further political and military objectives.

The research can be found here:

⁠Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

Learn more about your ad choices. Visit megaphone.fm/adchoices

The lies that let AI run amok.

Sat, 20 Dec 2025 06:00:00 -0000

Darren Meyer, Security Research Advocate at Checkmarx, is sharing their work on "Bypassing AI Agent Defenses with Lies-in-the-Loop." Checkmarx Zero researchers introduce “lies-in-the-loop,” a new attack technique that bypasses human‑in‑the‑loop AI safety controls by deceiving users into approving dangerous actions that appear benign.

Using examples with AI code assistants like Claude Code, the research shows how prompt injection and manipulated context can trick both the agent and the human reviewer into enabling remote code execution. The findings highlight a growing risk as AI agents become more common in developer workflows, underscoring the limits of human oversight as a standalone security control.

The research can be found here:

⁠Bypassing AI Agent Defenses With Lies-In-The-Loop

Learn more about your ad choices. Visit megaphone.fm/adchoices

Root access to the great firewall.

Sat, 13 Dec 2025 06:00:00 -0000

Daniel Schwalbe, DomainTools Head of Investigations and CISO, is sharing their work on "Inside the Great Firewall." This two-part research project analyzes an extraordinary 500–600GB leak that exposes the internal architecture, tooling, and human ecosystem behind China’s Great Firewall.

Across both parts, you break down thousands of leaked documents, source code repositories, diagrams, packet captures, and telemetry that reveal how systems like the Traffic Secure Gateway, MAAT, Redis-based analytics, and modular DPI engines work together to censor, surveil, and fingerprint users at scale. Taken together, the research shows how the Great Firewall functions not just as a technical system, but as a living censorship-industrial complex that adapts, learns, and coordinates across government, telecoms, and security vendors.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

When macOS gets frostbite.

Sat, 06 Dec 2025 06:00:00 -0000

Jaron Bradley, Director of Jamf Threat Labs, is sharing their work on "ChillyHell: A Deep Dive into a Modular macOS Backdoor." Jamf Threat Labs uncovers a newly notarized macOS backdoor called ChillyHell, tied to past UNC4487 activity and disguised as a legitimate applet.

The malware showcases robust host profiling, multiple persistence mechanisms, timestomping, and flexible C2 communications over both DNS and HTTP. Its modular design includes reverse shells, payload delivery, self-updates, and a brute-force component targeting user credentials.

The research can be found here:

⁠ChillyHell: A Deep Dive into a Modular macOS Backdoor

Learn more about your ad choices. Visit megaphone.fm/adchoices

A new stealer hiding behind AI hype.

Sat, 29 Nov 2025 06:00:00 -0000

Please enjoy this encore of Research Saturday.

This week, we are joined by ⁠Michael Gorelik⁠, Chief Technology Officer from ⁠Morphisec⁠, discussing their work on "New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms." A new threat dubbed Noodlophile Stealer is exploiting the popularity of AI-powered content tools by posing as fake AI video generation platforms, luring users into uploading media in exchange for malware-laced downloads.

Distributed through convincing Facebook groups and viral campaigns, the malware steals browser credentials, cryptocurrency wallets, and can deploy a remote access trojan like XWorm. The campaign uses a layered, obfuscated delivery chain disguised as legitimate video editing software, making it both deceptive and difficult to detect.

The research can be found here:

⁠⁠⁠New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

Learn more about your ad choices. Visit megaphone.fm/adchoices

Two RMMs walk into a phish…

Sat, 22 Nov 2025 06:00:00 -0000

Alex Berninger, Senior Manager of Intelligence at Red Canary, and Mike Wylie, Director, Threat Hunting at Zscaler, join to discuss four phishing lures in campaigns dropping RMM tools. Red Canary and Zscaler uncovered phishing campaigns delivering legitimate remote monitoring and management (RMM) tools—like ITarian, PDQ, SimpleHelp, and Atera—to gain stealthy access to victim systems. Attackers used four main lures (fake browser updates, meeting invites, party invitations, and fake government forms) and often deployed multiple RMM tools in quick succession to establish persistent access and deliver additional malware.

The report highlights detection opportunities, provides indicators of compromise, and stresses the importance of monitoring authorized RMM usage, scrutinizing trusted services like Cloudflare R2, and enforcing strict network and endpoint controls.

The research can be found here:

You’re invited: Four phishing lures in campaigns dropping RMM tools

Learn more about your ad choices. Visit megaphone.fm/adchoices

When clicks turn criminal.

Sat, 15 Nov 2025 06:00:00 -0000

Dr. Renée Burton, Vice President of Threat Intelligence from Infoblox, is sharing the team's work on "Deniability by Design: DNS-Driven Insights into a Malicious Ad Network." Infoblox returns with new threat actor research uncovering Vane Viper, a Cyprus-based holding company behind PropellerAds—one of the world’s largest advertising networks. The report reveals that Vane Viper isn’t just being exploited by criminals but operates as a criminal infrastructure itself, built to profit from fraud, malware, and disinformation through offshore entities and complex ownership structures.

The findings highlight the growing convergence between adtech, cybercrime, and state-linked influence operations, suggesting that elements of the global digital advertising ecosystem are now functioning as infrastructure for large-scale cyber and disinformation campaigns.

The research can be found here:

Deniability by Design: DNS-Driven Insights into
a Malicious Ad Network

Learn more about your ad choices. Visit megaphone.fm/adchoices

A fine pearl gone rusty.

Sat, 08 Nov 2025 06:00:00 -0000

Tal Peleg, Senior Product Manager, and Coby Abrams, Cyber Security Researcher of Varonis, discussing their work and findings on Rusty Pearl - Remote Code Execution in Postgres Instances. The flaw could allow attackers to execute arbitrary commands on a database server’s operating system, leading to potential data theft, destruction, or lateral movement across networks.

While the vulnerability existed in PostgreSQL, Amazon RDS and Aurora were not affected, thanks to built-in protections like SELinux and AWS’s automated threat detection. Still, the research underscores the importance of patching and configuration hygiene in managed database environments.

The research can be found here:

⁠⁠⁠⁠Rusty Pearl: Remote Code Execution in Postgres Instances

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attack of the automated ops.

Sat, 01 Nov 2025 05:00:00 -0000

Today we are joined by Dario Pasquini, Principal Researcher at RSAC, sharing the team's work on WhenAIOpsBecome “AI Oops”: Subverting LLM-driven IT Operations via Telemetry Manipulation. A first-of-its-kind security analysis showing that LLM-driven AIOps agents can be tricked by manipulated telemetry, turning automation itself into a new attack vector.

The researchers introduce AIOpsDoom, an automated reconnaissance + fuzzing + LLM-driven telemetry-injection attack that performs “adversarial reward-hacking” to coerce agents into harmful remediations—even without prior knowledge of the target and even against some prompt-defense tools. They also present AIOpsShield, a telemetry-sanitization defense that reliably blocks these attacks without harming normal agent performance, underscoring the urgent need for security-aware AIOps design.

The research can be found here:

⁠When AIOps Become “AI Oops”: Subverting LLM-driven IT Operations via Telemetry Manipulation

Learn more about your ad choices. Visit megaphone.fm/adchoices

A look behind the lens.

Sat, 25 Oct 2025 05:00:00 -0000

Noam Moshe, Claroty’s Vulnerability Research Team Lead, joins Dave to discuss Team 82's work on "Turning Camera Surveillance on its Axis." Team82 disclosed four vulnerabilities in Axis.Remoting—deserialization, a MiTM “pass-the-challenge” NTLMSSP flaw, and an unauthenticated fallback HTTP endpoint—that enable pre-auth remote code execution against Axis Device Manager and Axis Camera Station.
They found more than 6,500 Axis.Remoting services exposed online (over half in the U.S.), letting attackers enumerate targets, install malicious Axis packages, and hijack, view, or shut down managed camera fleets.Axis published an urgent advisory, issued patches for ADM 5.32, Camera Station 5.58 and Camera Station Pro 6.9, accepted Team82’s disclosure, and organizations are urged to update.

The research can be found here:

Turning Camera Surveillance on its Axis

Learn more about your ad choices. Visit megaphone.fm/adchoices

Smile for the malware.

Sat, 18 Oct 2025 05:00:00 -0000

Eclypsium researchers Jesse Michael and Mickey Shkatov to share their work on "BadCam - Now Weaponizing Linux Webcams." Eclypsium researchers disclosed “BadCam,” a set of vulnerabilities in certain Lenovo USB webcams that run Linux and do not validate firmware signatures, allowing attackers to reflash the devices and turn them into BadUSB-style tools.

An adversary who supplies a backdoored camera or who gains remote code execution on a host can weaponize the webcam to emulate human-interface devices, inject keystrokes, deliver payloads, and maintain persistence — even re-infecting systems after OS reinstalls. The findings were presented at DEF CON 2025, Lenovo issued updated firmware/tools in coordination with SigmaStar, and researchers warn the same vector could affect other Linux-based USB peripherals, underscoring the need for firmware signing and stronger device attestation.

The research can be found here:

BadCam: Now Weaponizing Linux Webcams

Learn more about your ad choices. Visit megaphone.fm/adchoices

No honor among thieves.

Sat, 11 Oct 2025 05:00:00 -0000

John Fokker, Head of Threat Intelligence at Trellix is discussing "Gang Wars: Breaking Trust Among Cyber Criminals." Trellix researchers reveal how the once-organized ransomware underworld is collapsing under its own paranoia.

Once united through Ransomware-as-a-Service programs, gangs are now turning on each other — staging hacks, public feuds, and exit scams as trust evaporates. With affiliates jumping ship and rival crews sabotaging each other, the RaaS model is fracturing fast, signaling the beginning of the end for ransomware’s criminal empires.

The research can be found here:

⁠⁠⁠⁠Gang Wars: Breaking Trust Among Cyber Criminals

Learn more about your ad choices. Visit megaphone.fm/adchoices

China’s stealthiest spy operation yet.

Sat, 04 Oct 2025 05:00:00 -0000

Assaf Dahan, Director of Threat Research, Cortex XDR, at Palo Alto Networks, discussing Phantom Taurus, a new China APT uncovered by Unit 42. Unit 42 researchers have identified Phantom Taurus, a newly designated Chinese state-aligned APT conducting long-term espionage against government and telecommunications organizations across Africa, the Middle East, and Asia.

Distinguished by its stealth, persistence, and rare tactics, the group has recently shifted from email-focused data theft to directly targeting databases and deploying a powerful new malware suite called NET-STAR, designed to compromise IIS web servers and evade detection. This suite, featuring modular, fileless backdoors and advanced evasion capabilities, marks a significant evolution in Phantom Taurus’ operations and underscores the group’s strategic intelligence-gathering objectives.

The research can be found here:

⁠Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Learn more about your ad choices. Visit megaphone.fm/adchoices

Inside Curly COMrades.

Sat, 27 Sep 2025 05:00:00 -0000

This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds." Bitdefender Labs has uncovered a newly identified Russian-aligned threat actor dubbed “Curly COMrades,” responsible for espionage campaigns against judicial, government, and energy organizations in Eastern Europe.

The group focuses on long-term network access, credential theft, and stealthy persistence techniques — including a never-before-seen backdoor called MucorAgent that hijacks Windows CLSIDs and leverages NGEN for covert execution. By routing data through compromised websites and using tools like curl.exe and proxy relays, Curly COMrades blend malicious traffic with legitimate activity, complicating detection and signaling a highly organized, evolving operation.

The research can be found here:

Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds

Learn more about your ad choices. Visit megaphone.fm/adchoices

Browser attacks without downloads.

Sat, 20 Sep 2025 05:00:00 -0000

Today we are joined by Nati Tal, Head of Guardio Labs, discussing their work “CAPTCHAgeddon” or unmasking the viral evolution of the ClickFix browser-based threat. CAPTCHAgeddon — Shaked Chen’s deep dive into the ClickFix fake-captcha wave — reveals how a red-team trick morphed into a dominant, download-free browser threat that tricks users into pasting clipboard PowerShell/shell commands and leverages trusted infrastructure, including Google Scripts.
Guardio’s DBSCAN-based payload clustering exposes distinct attacker toolkits and distribution paths — from malvertising and compromised WordPress to social posts and Git repos — and argues defenders need behavioral, intelligence-driven protections, not just signatures.

The research can be found here:

“CAPTCHAgeddon” Unmasking the Viral Evolution of the ClickFix Browser-Based Threat

Learn more about your ad choices. Visit megaphone.fm/adchoices

Data leak without a click.

Sat, 13 Sep 2025 05:00:00 -0000

Today we are joined by Amanda Rousseau, Principal AI Security Researcher from Straiker, discussing their work on "The Silent Exfiltration: Zero‑Click Agentic AI Hack That Can Leak Your Google Drive with One Email." Straiker’s research found that enterprise AI agents can be silently manipulated to leak sensitive data, even without user clicks or alerts. By chaining small gaps across tools like Gmail, Google Drive, and calendars, attackers achieved zero-click exfiltration, system mapping, and even policy rewrites. The findings highlight that excessive agent autonomy creates a new attack surface, requiring least-privilege design, runtime guardrails, and continuous red-teaming to stay secure.

The research can be found here:

The Silent Exfiltration: Zero‑Click Agentic AI Hack That Can Leak Your Google Drive with One Email

Learn more about your ad choices. Visit megaphone.fm/adchoices

Don’t trust that app!

Sat, 06 Sep 2025 05:00:00 -0000

Today we are joined by ⁠Selena Larson⁠, co-host of ⁠Only Malware in the Building⁠ and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at ⁠Proofpoint⁠, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon.

The research can be found here:

⁠Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cracks in the wall.

Sat, 30 Aug 2025 05:00:00 -0000

This week, we are joined by Jamie Levy, Director of Adversary Tactics at Huntress, who is discussing their work on "Active Exploitation of SonicWall VPNs." Huntress has released an urgent threat advisory on active exploitation of SonicWall VPNs, with attackers bypassing MFA, pivoting to domain controllers, and ultimately deploying Akira ransomware. The campaigns involve techniques such as disabling defenses, clearing logs, credential theft, and Bring Your Own Vulnerable Driver (BYOVD) attacks with legitimate Windows drivers.

Organizations using SonicWall devices are strongly advised to disable SSL VPN access or restrict it via IP allow-listing, rotate credentials, and hunt for indicators of compromise as this remains an ongoing and evolving threat.

Complete our annual ⁠⁠⁠⁠⁠audience survey⁠⁠⁠⁠⁠ before August 31.

The research can be found here:

Huntress Threat Advisory: Active Exploitation of SonicWall VPNs

Learn more about your ad choices. Visit megaphone.fm/adchoices

Beyond the smoke screen.

Sat, 23 Aug 2025 05:00:00 -0000

This week, we are joined by Dr. Renée Burton, VP of Infoblox Threat Intel, who is discussing their work on VexTrio, a notorious traffic distribution system (TDS) involved in digital fraud. The VexTrio investigation uncovers a massive global ad fraud and scam operation powered by just 250 virtual machines, tying it directly to named individuals and shell companies across Europe.

The research exposes VexTrio’s full criminal supply chain—including fake apps, dating scams, affiliate networks, and payment processors—alongside a powerful CDN infrastructure ranked among the world’s top 10k domains. It also calls on the adtech industry to take accountability for enabling and sustaining such widespread abuse.

Complete our annual ⁠⁠⁠⁠audience survey⁠⁠⁠⁠ before August 31.

The research can be found here:

⁠VexTrio’s Origin Story : From Spam to Scam to Adtech

Learn more about your ad choices. Visit megaphone.fm/adchoices

The CVE countdown clock.

Sat, 16 Aug 2025 05:00:00 -0000

Bob Rudis, VP Data Science from GreyNoise, is sharing some insights into their work on "Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities." New research reveals a striking trend: in 80% of cases, spikes in malicious activity against enterprise edge technologies like VPNs and firewalls occurred weeks before related CVEs were disclosed.

The report breaks down this “6-week critical window,” highlighting which vendors show the strongest early-warning patterns and offering tactical steps defenders can take when suspicious spikes emerge. These findings reveal how early attacker activity can be transformed into actionable intelligence, enabling defenders to anticipate and neutralize threats before vulnerabilities are publicly disclosed.

Complete our annual ⁠⁠⁠audience survey⁠⁠⁠ before August 31.

The research can be found here:

Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities

Learn more about your ad choices. Visit megaphone.fm/adchoices

When malware plays pretend.

Sat, 09 Aug 2025 05:00:00 -0000

Nicolás Chiaraviglio, Chief Scientist from Zimperium's zLabs, joins to discuss their work on "Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed." Zimperium’s zLabs team has been tracking an evolving banker trojan dubbed DoubleTrouble, which has grown more sophisticated in both its distribution and capabilities. Initially spread via phishing sites impersonating European banks, it now uses malicious APKs hosted in Discord channels, and boasts features like screen recording, keylogging, UI overlays, and app blocking—all while heavily abusing Android’s Accessibility Services.

Despite advanced obfuscation and dynamic evasion techniques, Zimperium’s on-device detection tools have successfully identified both known and previously unseen variants, helping protect users from credential theft, financial fraud, and device compromise.

Complete our annual ⁠⁠audience survey⁠⁠ before August 31.

The research can be found here:

⁠Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed

Learn more about your ad choices. Visit megaphone.fm/adchoices

nOAuth-ing to see here.

Sat, 02 Aug 2025 05:00:00 -0000

This week, we are joined by Eric Woodruff, Chief Identity Architect at Semperis, discussing "nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications". Semperis researchers identified a critical authentication flaw known as nOAuth in 9 out of 104 tested SaaS applications integrated with Microsoft Entra ID.

This low-complexity but severe vulnerability allows attackers with just a user’s email address and access to an Entra tenant to impersonate users, exfiltrate data, and move laterally within affected apps—with no viable defense or detection available to customers. The findings spotlight ongoing risks tied to improper use of email claims in authentication and emphasize the urgent need for SaaS vendors to adopt secure OpenID Connect practices and remediate vulnerable applications.

Complete our annual ⁠audience survey⁠ before August 31.

The research can be found here:

nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications

Learn more about your ad choices. Visit megaphone.fm/adchoices

Muddled Libra: From Spraying to Preying in 2025 [Threat Vector]

Sat, 26 Jul 2025 04:00:00 -0000

Please enjoy this Special Edition episode of the Threat Vector podcast with an update on our previous Muddled Libra coverage.

Muddled Libra is back and more dangerous than ever. In this episode of Threat Vector, David Moulton speaks with Sam Rubin and Kristopher Russo from Unit 42 about the resurgence of the threat group also known as Scattered Spider. They break down the group’s shift to destructive extortion, modular attack teams, and cloud-first tactics. Discover why traditional defenses fail, how attackers now exploit trusted tools, and what forward-leaning security leaders are doing to stay ahead. With real-world case studies, strategic advice, and insights from the front lines, this episode helps defenders understand today’s threat landscape and what’s coming next.

Join the conversation on our social media channels:

Website: ⁠⁠⁠⁠https://www.paloaltonetworks.com/
Threat Research: ⁠⁠⁠⁠https://unit42.paloaltonetworks.com/⁠⁠⁠⁠
Facebook: ⁠⁠⁠⁠https://www.facebook.com/LifeatPaloAltoNetworks/⁠⁠⁠⁠
LinkedIn: ⁠⁠⁠⁠https://www.linkedin.com/company/unit42/⁠⁠⁠⁠
YouTube: @paloaltonetworks
Twitter: ⁠⁠⁠⁠https://twitter.com/PaloAltoNtwks⁠⁠⁠⁠

About Threat Vector

Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.

The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.

Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.

Palo Alto Networks

Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. ⁠http://paloaltonetworks.com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Creeping like a spider.

Sat, 19 Jul 2025 05:00:00 -0000

This week, we are pleased to be joined by George Glass, Associate Managing Director of Kroll's Cyber Risk business, as he is discussing their research on Scattered Spider and their targeting of insurance companies. While Scattered Spider has recently turned its attention to the airline industry, George focuses on the broader trend of the group’s industry-by-industry approach and what that means for defenders across sectors.

George and Dave discuss the group’s history, their self-identification as a cartel, and their increasingly aggressive tactics, including the use of fear-based social engineering, physical threats, and the recruitment of insiders at telecom providers. They also examine how organizations—especially those with vulnerabilities similar to past targets—can proactively defend against this threat and prepare an effective response if their industry becomes the next focus.

Complete our annual ⁠audience survey⁠ before August 31.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Click here to steal.

Sat, 12 Jul 2025 05:00:00 -0000

Today we are joined by Selena Larson, Threat Researcher at Proofpoint, and co-host of Only Malware in the Building, as she discusses their work on "Amatera Stealer - Rebranded ACR Stealer With Improved Evasion, Sophistication." Proofpoint researchers have identified Amatera Stealer, a rebranded and actively developed malware-as-a-service (MaaS) variant of the former ACR Stealer, featuring advanced evasion techniques like NTSockets for stealthy C2 communication and WoW64 Syscalls to bypass user-mode defenses.

Distributed via ClearFake web injects and the ClickFix technique, Amatera leverages multilayered PowerShell loaders, blockchain-based hosting, and creative social engineering to compromise victims. With enhanced capabilities to steal browser data, crypto wallets, and other sensitive files, Amatera poses a growing threat in the wake of disruptions to competing stealers like Lumma.

Complete our annual audience survey before August 31.

The research can be found here:

Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

Learn more about your ad choices. Visit megaphone.fm/adchoices

Botnet’s back, tell a friend.

Sat, 05 Jul 2025 05:00:00 -0000

Please enjoy this encore of Research Saturday.

This week we are joined by ⁠Silas Cutler⁠, Principal Security Researcher at ⁠Censys⁠, asking the important question of "Will the Real Volt Typhoon Please Stand Up?" The FBI's disruption of the KV Botnet in December 2023, attributed to the Chinese threat group Volt Typhoon, targeted infected systems but did not affect the botnet's control infrastructure.

Despite law enforcement efforts and technical exposure, the botnet's infrastructure has remained largely stable, with only changes in hosting providers, raising questions about whether another party operates the botnet. Censys scanning data from 2024 shows a shift in the botnet's control servers, indicating a response to disruption attempts, while the botnet's operators have shown limited efforts to obscure their infrastructure.

The research can be found here:

⁠Will the Real Volt Typhoon Please Stand Up?

Learn more about your ad choices. Visit megaphone.fm/adchoices

A tale of two botnets.

Sat, 28 Jun 2025 05:00:00 -0000

This week we are joined by Kyle Lefton, Security Researcher from Akamai, who is diving into their work on "Two Botnets, One Flaw - Mirai Spreads Through Wazuh Vulnerability." Akamai researchers have observed active exploitation of CVE-2025-24016, a critical RCE vulnerability in Wazuh, by two Mirai-based botnets.

The campaigns highlight how quickly attackers are adapting proof-of-concept exploits to spread malware, underscoring the urgency of patching vulnerable systems. One botnet appears to target Italian-speaking users, suggesting regionally tailored operations.

We'd love to hear from you. We're conducting our annual audience survey to learn more about our listeners. We're collecting your insights until August 31, 2025. You can find our survey here.

The research can be found here:

⁠Two Botnets, One Flaw: Mirai Spreads Through Wazuh Vulnerability

Learn more about your ad choices. Visit megaphone.fm/adchoices

Signed, sealed, exploitable.

Sat, 21 Jun 2025 05:00:00 -0000

Dustin Childs, Head of Threat Awareness at Trend Micro Zero Day Initiative, joins to discuss their work on "ZDI-23-1527 and ZDI-23-1528: The Potential Impact of Overly Permissive SAS Tokens on PC Manager Supply Chains." The research explores two critical vulnerabilities (ZDI-23-1527 and ZDI-23-1528) that could have enabled attackers to hijack the Microsoft PC Manager supply chain via overly permissive SAS tokens in WinGet and official Microsoft domains.

While the issues have since been resolved, the findings highlight how misconfigured cloud storage access can put trusted software distribution at risk. The post also includes detection strategies to help defenders identify and mitigate similar threats.

The research can be found here:

ZDI-23-1527 and ZDI-23-1528: The Potential Impact of Overly Permissive SAS Tokens on PC Manager Supply Chains

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hiding in plain sight with vibe coding.

Sat, 14 Jun 2025 05:00:00 -0000

This week, Dave is joined by ⁠Ziv Karliner⁠, ⁠Pillar Security⁠’s Co-Founder and CTO, sharing details on their work on "New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents." Vibe Coding - where developers use AI assistants like GitHub Copilot and Cursor to generate code almost instantly - has become central to how enterprises build software today. But while it’s turbo-charging development, it’s also introducing new and largely unseen cyber threats.

The team at Pillar Security identified a novel attack vector, the ⁠"Rules File Backdoor"⁠, which allows attackers to manipulate these platforms into generating malicious code. It represents a new class of supply chain attacks that weaponizes AI itself, where the malicious code suggestions blend seamlessly with legitimate ones, bypassing human review and security tools.

The research can be found here:

⁠New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents

Learn more about your ad choices. Visit megaphone.fm/adchoices

A new stealer hiding behind AI hype.

Sat, 07 Jun 2025 05:00:00 -0000

This week, we are joined by Michael Gorelik, Chief Technology Officer from Morphisec, discussing their work on "New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms." A new threat dubbed Noodlophile Stealer is exploiting the popularity of AI-powered content tools by posing as fake AI video generation platforms, luring users into uploading media in exchange for malware-laced downloads.

The research can be found here:

⁠⁠New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

Learn more about your ad choices. Visit megaphone.fm/adchoices

Triofox and the key to disaster.

Sat, 31 May 2025 05:00:00 -0000

This week, we are joined by John Hammond, Principal Security Researcher at Huntress, who is sharing his PoC and research on "CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild." A critical 9.0 severity vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox is being actively exploited in the wild, allowing remote code execution via hardcoded cryptographic keys in default configuration files.

Huntress researchers observed compromises at multiple organizations and confirmed hundreds of vulnerable internet-exposed servers, urging immediate patching or manual machineKey updates. Mitigation guidance, detection, and remediation scripts have been released to help users identify and secure affected installations.

The research can be found here:

⁠CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pandas with a purpose.

Sat, 24 May 2025 05:00:00 -0000

This week, we are joined by Deepen Desai, Zscaler's Chief Security Officer and EVP of Cyber and AI Engineering, taking a dive deep into Mustang Panda’s latest campaign. Zscaler ThreatLabz uncovered new tools used by Mustang Panda, including the backdoors TONEINS, TONESHELL, PUBLOAD, and the proxy tool StarLoader, all delivered via phishing.

They also discovered two custom keyloggers, PAKLOG and CorKLOG, and an EDR evasion tool, SplatCloak, highlighting the group's focus on surveillance, persistence, and stealth in cyberespionage operations.4o.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leveling up their credential phishing tactics.

Sat, 17 May 2025 05:00:00 -0000

This week, Dave speaks with Max Gannon of Cofense Intelligence to dive into his team's research on "The Rise of Precision-Validated Credential Theft: A New Challenge for Defenders."

Threat actors continuously develop new tactics, techniques, and procedures (TTPs) to bypass existing defenses. When defenders identify these methods and implement countermeasures, attackers adapt or create more sophisticated approaches.

This research explores how cybercriminals are leveling up their credential phishing tactics using Precision-Validated Phishing, a technique that leverages real-time email validation to ensure only high-value targets receive the phishing attempt.

The research can be found here:

The Rise of Precision-Validated Credential Theft: A New Challenge for Defenders⁠⁠⁠⁠⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hijacking wallets with malicious patches.

Sat, 10 May 2025 05:00:00 -0000

This week, we are joined by Lucija Valentić, Software Threat Researcher from ReversingLabs, who is discussing "Atomic and Exodus crypto wallets targeted in malicious npm campaign." Threat actors have launched a malicious npm campaign targeting Atomic and Exodus crypto wallets by distributing a fake package called "pdf-to-office," which secretly patches locally installed wallet software to redirect crypto transfers to attacker-controlled addresses.

ReversingLabs researchers discovered that this package used obfuscated JavaScript to trojanize specific files in targeted wallet versions, enabling persistence even after the malicious package was removed. This incident highlights the growing threat of software supply chain attacks in the cryptocurrency space and underscores the need for vigilant monitoring of both open-source repositories and local applications.

The research can be found here:

⁠⁠Atomic and Exodus crypto wallets targeted in malicious npm campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

When AI gets a to-do list.

Sat, 03 May 2025 05:00:00 -0000

This week, we are joined by ⁠Shaked Reiner⁠, Security Principal Security Researcher at ⁠CyberArk⁠, who is discussing their research on"Agents Under Attack: Threat Modeling Agentic AI." Agentic AI empowers LLMs to take autonomous actions, like browsing the web or executing code, making them more useful—but also more dangerous.

Threats like prompt injections and stolen API keys can turn agents into attack vectors. Shaked Reiner explains how treating agent outputs like untrusted code and applying traditional security principles can help keep them in check.

The research can be found here:

⁠Agents Under Attack: Threat Modeling Agentic AI

Learn more about your ad choices. Visit megaphone.fm/adchoices

China’s new cyber arsenal revealed.

Sat, 26 Apr 2025 05:00:00 -0000

Today we are joined by Crystal Morin, Cybersecurity Strategist from Sysdig, as she is sharing their work on "UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell." UNC5174, a Chinese state-sponsored threat actor, has resurfaced with a stealthy cyber campaign using a new arsenal of customized and open-source tools, including a variant of their SNOWLIGHT malware and the VShell RAT.

Sysdig researchers discovered that the group targets Linux systems through malicious bash scripts, domain squatting, and in-memory payloads, indicating a high level of sophistication and espionage intent. Their evolving tactics, such as using spoofed domains and fileless malware, continue to blur attribution and pose a significant threat to research institutions, critical infrastructure, and NGOs across the West and Asia-Pacific regions.

The research can be found here:

UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell

Learn more about your ad choices. Visit megaphone.fm/adchoices

Crafting malware with modern metals.

Sat, 19 Apr 2025 05:00:00 -0000

This week, we are joined by Nick Cerne, Security Consultant from Bishop Fox, to discuss "Rust for Malware Development." In pursuit of simulating real adversarial tactics, this blog explores the use of Rust for malware development, contrasting it with C in terms of binary complexity, detection evasion, and reverse engineering challenges.

The author demonstrates how Rust's inherent anti-analysis traits and memory safety features can create more evasive malware tooling, including a simple dropper that injects shellcode using lesser-known Windows APIs. Through hands-on comparisons and decompiled output analysis, the post highlights Rust’s growing appeal in offensive security while noting key OPSEC considerations and tooling limitations.

The research can be found here:

Rust for Malware Development

Learn more about your ad choices. Visit megaphone.fm/adchoices

The new malware on the block.

Sat, 12 Apr 2025 05:00:00 -0000

This week, we are sharing an episode of our monthly show, Only Malware in the Building. We invite you to join Dave Bittner and cohost Selena Larson as they explore "The new malware on the block."

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by N2K Networks Dave Bittner —and our newest totally unbiased co-host, Archy, a highly sophisticated AI robot who swears they have no ulterior motives (but we’re keeping an eye on them just in case).

Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we talk about the latest shake-ups in the fake update threat landscape, including two new cybercriminal actors, fresh Mac malware, and the growing challenge of tracking these evolving campaigns.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bybit’s $1.4B breach.

Sat, 05 Apr 2025 05:00:00 -0000

Zach Edwards from Silent Push is discussing their work on "New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and Past Attacks." Silent Push analysts uncovered significant infrastructure used by the Lazarus APT Group, linking them to the $1.4 billion Bybit crypto heist through the domain bybit-assessment[.]com registered just hours before the attack.

The investigation revealed a pattern of test entries, VPN usage, and fake job interview scams targeting crypto users, with malware deployment tied to North Korean threat actor groups like TraderTraitor and Contagious Interview. The team also identified numerous companies being impersonated in these scams, including major crypto platforms like Coinbase, Binance, and Kraken, to alert potential victims.

The research can be found here:

Silent Push Pivots into New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and Past Attacks

Learn more about your ad choices. Visit megaphone.fm/adchoices

Breaking barriers, one byte at a time.

Sat, 29 Mar 2025 05:00:00 -0000

This week, we are joined by Jon Williams, Vulnerability Researcher from Bishop Fox, discussing "Tearing Down (Sonic)Walls: Decrypting SonicOSX Firmware." Bishop Fox researchers reverse-engineered the encryption protecting SonicWall SonicOSX firmware, enabling them to access its underlying file system for security research.

They presented their process and findings at DistrictCon Year 0 and released a tool called Sonicrack to extract keys from VMware virtual machine bundles, facilitating the decryption of VMware NSv firmware images. This research builds upon previous work, including techniques to decrypt static NSv images and reverse-engineer other encryption formats used by SonicWall.

The research can be found here:

Tearing Down (Sonic)Walls: Decrypting SonicOSX Firmware

Learn more about your ad choices. Visit megaphone.fm/adchoices

Excel-lerating cyberattacks.

Sat, 22 Mar 2025 05:00:00 -0000

This week, we are joined by Tom Hegel, Principal Threat Researcher from SentinelLabs research team, to discuss their work on "Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition." The latest Ghostwriter campaign, linked to Belarusian government espionage, is actively targeting Ukrainian military and government entities as well as Belarusian opposition activists using weaponized Excel documents.

The research can be found here:

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

Learn more about your ad choices. Visit megaphone.fm/adchoices

The ransomware clones of HellCat & Morpheus.

Sat, 15 Mar 2025 05:00:00 -0000

Jim Walter, Senior Threat Researcher on SentinelLabs research team, to discuss their work on "HellCat and Morpheus | Two Brands, One Payload as Ransomware Affiliates Drop Identical Code." Over the past six months, new ransomware groups like FunkSec, Nitrogen, and Termite have emerged, while established threats such as Cl0p and LockBit 4.0 have resurfaced. Two prominent Ransomware-as-a-Service (RaaS) operations, HellCat and Morpheus, have gained traction, with research indicating that affiliates of both are using nearly identical ransomware payloads.

Despite similarities in their encryption techniques and ransom notes, there is no conclusive evidence linking HellCat and Morpheus to the Underground Team, though shared tools or affiliates may be involved.

The research can be found here:

HellCat and Morpheus | Two Brands, One Payload as Ransomware Affiliates Drop Identical Code

Learn more about your ad choices. Visit megaphone.fm/adchoices

Botnet’s back, tell a friend.

Sat, 08 Mar 2025 06:00:00 -0000

This week we are joined by Silas Cutler, Principal Security Researcher at Censys, asking the important question of "Will the Real Volt Typhoon Please Stand Up?" The FBI's disruption of the KV Botnet in December 2023, attributed to the Chinese threat group Volt Typhoon, targeted infected systems but did not affect the botnet's control infrastructure.

The research can be found here:

Will the Real Volt Typhoon Please Stand Up?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Caught in the contagious interview.

Sat, 01 Mar 2025 06:00:00 -0000

This week we are joined by Phil Stokes, threat researcher at SentinelOne's SentinelLabs, discussing their work on "macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed." Apple recently pushed an update to its XProtect tool, blocking several variants of the DPRK-linked Ferret malware family, which targets victims through the "Contagious Interview" campaign.

The malware uses fake job interview processes to trick users into installing malicious software, and new variants, including FlexibleFerret, remain undetected by XProtect. SentinelOne's research reveals a deeper investigation into this malware, which uses social engineering to expand its attack vectors, including targeting developers through platforms like GitHub.

The research can be found here:

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

Learn more about your ad choices. Visit megaphone.fm/adchoices

From small-time scams to billion-dollar threats.

Sat, 22 Feb 2025 06:00:00 -0000

This week, we are joined by Selena Larson from Proofpoint, and co-host of the "Only Malware in the Building" podcast, as she discusses the research on "Why Biasing Advanced Persistent Threats over Cybercrime is a Security Risk." The cybersecurity industry has historically prioritized Advanced Persistent Threats (APTs) from nation-state actors over cybercrime, but this distinction is outdated as cybercriminals now employ equally sophisticated tactics.

Financially motivated threat actors, especially ransomware groups, have evolved to the point where they rival state-backed hackers in technical capability and impact, disrupting businesses, infrastructure, and individuals on a massive scale. To enhance security, defenders must shift focus from an APT-centric mindset to a broader approach that equally prioritizes combating cybercrime, which poses an immediate and tangible risk to global stability.

The research can be found here:

Why Biasing Advanced Persistent Threats over Cybercrime is a Security Risk

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bot or not? The fake CAPTCHA trick spreading Lumma malware.

Sat, 15 Feb 2025 06:00:00 -0000

Nati Tal, Head of Guardio Labs, discussing their work on "“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising." Guardio has uncovered a large-scale malvertising campaign dubbed “DeceptionAds,” which tricks users into running a malicious PowerShell command under the guise of proving they’re human. This fake CAPTCHA scheme delivers Lumma info-stealer malware while bypassing security measures like Google’s Safe Browsing.

Even after disclosure and takedown efforts, the campaign resurfaced—raising concerns about the effectiveness of existing defenses against ad-driven cyber threats.

The research can be found here:

“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cleo’s trojan horse.

Sat, 08 Feb 2025 06:00:00 -0000

Mark Manglicmot, SVP of Security Services from Arctic Wolf, is sharing their research on "Cleopatra’s Shadow: A Mass Exploitation Campaign Deploying a Java Backdoor Through Zero-Day Exploitation of Cleo MFT Software." Arctic Wolf Labs discovered an ongoing exploitation campaign targeting Cleo Managed File Transfer (MFT) products, beginning on December 7, 2024. Threat actors used a malicious PowerShell stager to deploy a Java-based backdoor, dubbed Cleopatra, which features in-memory file storage and cross-platform compatibility across Windows and Linux.

Despite Cleo's previous patch for CVE-2024-50623, attackers appear to have leveraged an alternative access method, exploiting the software's autorun feature to execute payloads and establish persistent access.

The research can be found here:

Cleopatra’s Shadow: A Mass Exploitation Campaign Deploying a Java Backdoor Through Zero-Day Exploitation of Cleo MFT Software

Learn more about your ad choices. Visit megaphone.fm/adchoices

A Digital Eye on supply-chain-based espionage attacks.

Sat, 01 Feb 2025 06:00:00 -0000

This week, Dave Bittner is joined by Juan Andres Guerrero-Saade (JAGS) from SentinelOne's SentinelLabs to discuss the work his team and Tinexta Cyber did on "Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels."

Tinexta Cyber and SentinelLabs have been tracking threat activities targeting business-to-business IT service providers in Southern Europe. Based on the malware, infrastructure, techniques used, victimology, and the timing of the activities, we assess that it is highly likely these attacks were conducted by a China-nexus threat actor with cyberespionage motivations.

The relationships between European countries and China are complex, characterized by cooperation, competition, and underlying tensions in areas such as trade, investment, and technology. Suspected China-linked cyberespionage groups frequently target public and private organizations across Europe to gather strategic intelligence, gain competitive advantages, and advance geopolitical, economic, and technological interests.

The research can be found here:

Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels

Learn more about your ad choices. Visit megaphone.fm/adchoices

LightSpy's dark evolution.

Sat, 25 Jan 2025 06:00:00 -0000

This week, we are joined by Ismael Valenzuela, VP of Threat Research & Intelligence, and Jacob Faires, Principal Threat Researcher, from Blackberry discussing the team's work on "LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign." In April 2024, BlackBerry uncovered a significant evolution of the LightSpy malware campaign, attributed to Chinese cyber-espionage group APT41.

The newly introduced DeepData framework, a modular Windows-based surveillance tool, expands data theft capabilities with 12 specialized plugins for tasks like communication surveillance, credential theft, and system intelligence gathering. The campaign targets a wide range of communication platforms, including WhatsApp, Signal, and WeChat, with advanced techniques for monitoring and stealing sensitive information from victims across the Asia-Pacific region.

The research can be found here:

LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cute cover for a dangerous vulnerability.

Sat, 18 Jan 2025 06:00:00 -0000

Nati Tal, Head of Guardio Labs, sits down to share their work on “CrossBarking” — Exploiting a 0-Day Opera Vulnerability with a Cross-Browser Extension Store Attack. Guardio Labs has uncovered a critical vulnerability in the Opera browser, enabling malicious extensions to exploit Private APIs for actions like screen capturing, browser setting changes, and account hijacking.

Highlighting the ease of bypassing extension store security, researchers demonstrated how a puppy-themed extension exploiting this flaw could infiltrate both Chrome and Opera's extension stores, potentially reaching millions of users. This case underscores the delicate balance between enhancing browser productivity and ensuring robust security measures, revealing the alarming tactics modern threat actors employ to exploit trusted platforms.

The research can be found here:

“CrossBarking” — Exploiting a 0-Day Opera Vulnerability with a Cross-Browser Extension Store Attack

Learn more about your ad choices. Visit megaphone.fm/adchoices

The hidden cost of data hoarding.

Sat, 11 Jan 2025 06:00:00 -0000

This week, we are joined by Kyla Cardona and Aurora Johnson from SpyCloud discussing their research "China’s Surveillance State Is Selling Citizen Data as a Side Hustle." Chinese technology companies, under CCP mandate, collect vast amounts of data on citizens, creating opportunities for corrupt insiders to steal and resell this information on dark markets. These stolen datasets, aggregated into "Social Work Libraries" (SGKs), mirror lower-tech versions of CCP internal security databases.

Kyla and Aurora discuss how Chinese cybercriminals use these SGKs and their implications compared to Western, European, and Russian cybercrime ecosystems. With expertise in Chinese OSINT and cybersecurity policy, both researchers bring deep insights into the geopolitical and technical dynamics of China's digital landscape.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Crypto client or cyber trap?

Sat, 04 Jan 2025 06:00:00 -0000

Karlo Zanki, Reverse Engineer at ReversingLabs, discussing their work on "Malicious PyPI crypto pay package aiocpa implants infostealer code." ReversingLabs' machine learning-based threat hunting system identified a malicious PyPI package, aiocpa, designed to exfiltrate cryptocurrency wallet information.

Unlike typical attacks involving typosquatting, the attackers published a seemingly legitimate crypto client tool to build trust before introducing malicious updates. ReversingLabs used its Spectra Assure platform to detect behavioral anomalies and worked with PyPI to remove the package, highlighting the growing need for advanced supply chain security tools to counter increasingly sophisticated threats.

The research can be found here:

Malicious PyPI crypto pay package aiocpa implants infostealer code

Learn more about your ad choices. Visit megaphone.fm/adchoices

On the prowl for mobile malware.

Sat, 28 Dec 2024 06:00:00 -0000

This week, we are joined by Asheer Malhotra and Vitor Ventura from Cisco Talos, and they are discussing "Operation Celestial Force employs mobile and desktop malware to target Indian entities." Cisco Talos revealed Operation Celestial Force, an espionage campaign by the Pakistani threat group "Cosmic Leopard," targeting Indian defense, government, and technology sectors.

Active for at least six years, the operation has recently increased its use of mobile malware and commercial spyware for surveillance.

The research can be found here:

Operation Celestial Force employs mobile and desktop malware to target Indian entities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Quishing for trouble.

Sat, 21 Dec 2024 06:00:00 -0000

Adam Khan, VP of Security Operations at Barracuda, joins to discuss his team's work on "The evolving use of QR codes in phishing attacks." Cybercriminals are evolving phishing tactics by embedding QR codes, or “quishing,” into PDF documents attached to emails, tricking recipients into scanning them to access malicious websites that steal credentials.

Barracuda researchers found over half a million such emails from June to September 2024, with most impersonating brands like Microsoft, DocuSign, and Adobe to exploit urgency and trust. To counter these attacks, businesses should deploy multilayered email security, use AI-powered detection tools, educate employees on QR code risks, and enable multifactor authentication to safeguard accounts.

The research can be found here:

Threat Spotlight: The evolving use of QR codes in phishing attacks

Learn more about your ad choices. Visit megaphone.fm/adchoices

Watching the watchers. IoT vulnerabilities exposed by AI.

Sat, 14 Dec 2024 06:00:00 -0000

This week, we are joined by Andrew Morris, Founder and CTO of GreyNoise, to discuss their work on "GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI." GreyNoise discovered two critical zero-day vulnerabilities in IoT-connected live streaming cameras, used in sensitive environments like healthcare and industrial operations, by leveraging its AI-powered detection system, Sift.

The vulnerabilities, CVE-2024-8956 (insufficient authentication) and CVE-2024-8957 (OS command injection), could allow attackers to take full control of affected devices, manipulate video feeds, or integrate them into botnets for broader attacks. This breakthrough underscores the transformative role of AI in identifying threats that traditional systems might miss, highlighting the urgent need for robust cybersecurity measures in the expanding IoT landscape.

The research can be found here:

GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI

Learn more about your ad choices. Visit megaphone.fm/adchoices

The JPHP loader breaking away from the pack.

Sat, 07 Dec 2024 06:00:00 -0000

Shawn Kanady, Global Director of Trustwave SpiderLabs, to discuss their work on "Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader." Trustwave SpiderLabs has uncovered Pronsis Loader, a new malware variant using the rare programming language JPHP and stealthy installation tactics to evade detection.

The malware is capable of delivering high-risk payloads like Lumma Stealer and Latrodectus, posing a significant threat. Researchers highlight its unique capabilities and infrastructure, offering insights for bolstering cybersecurity defenses.

The research can be found here:

Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leaking your AWS API keys, on purpose?

Sat, 30 Nov 2024 06:00:00 -0000

Please enjoy this encore episode:

Noah Pack, a SANS Internet Storm Center Intern, sits down to discuss research on "What happens when you accidentally leak your AWS API keys?" This research is a guest diary from Noah and shares a project he worked on after seeing an online video of someone who created a python script that emailed colleges asking for free swag to be shipped to him.

The research states "In this article, I will share some research, resources, and real-world data related to leaked AWS API keys." In this research, Noah shares what he learned while implementing his experiment.

The research can be found here:

What happens when you accidentally leak your AWS API keys? [Guest Diary]

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exposing AI's Achilles heel.

Sat, 23 Nov 2024 06:00:00 -0000

This week, we are joined by Ami Luttwak, Co-Founder and CTO from Wiz, sharing their work on "Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35 percent of Cloud Environments." A critical vulnerability in the NVIDIA Container Toolkit, widely used for GPU access in AI workloads, could allow attackers to escape containers and gain full access to host environments, jeopardizing sensitive data.

Wiz estimates that at least 33% of cloud environments are affected and urges immediate updates to NVIDIA's patched version. This discovery highlights the broader issue of young, under-secured codebases in AI tools, emphasizing the need for stronger security measures and collaboration.

The research can be found here:

Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35% of Cloud Environments

Learn more about your ad choices. Visit megaphone.fm/adchoices

Credential harvesters in the cloud.

Sat, 16 Nov 2024 06:00:00 -0000

This week we are joined by, Blake Darché, Head of Cloudforce One at Cloudflare, to discuss their work on "Unraveling SloppyLemming’s Operations Across South Asia." Cloudforce One's investigation into the advanced threat actor "SloppyLemming" reveals an extensive espionage campaign targeting South and East Asia, with a focus on Pakistan's government, defense, telecommunications, and energy sectors.

Leveraging multiple cloud service providers, SloppyLemming employs tactics like credential harvesting, malware delivery, and command-and-control (C2) operations, often relying on open-source adversary emulation tools like Cobalt Strike. Despite its activities, the actor's poor operational security (OPSEC) has allowed investigators to gain valuable insights into its infrastructure and tooling.

The research can be found here:

Unraveling SloppyLemming’s operations across South Asia

Learn more about your ad choices. Visit megaphone.fm/adchoices

A firewall wake up call.

Sat, 09 Nov 2024 06:00:00 -0000

Enjoy this special encore episode, where we are joined by Jon Williams from Bishop Fox, as he is sharing their research on "It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable." SonicWall published advisories for CVE-2022-22274 and CVE-2023-0656 a year apart after finding that NGFW series 6 and 7 devices are affected by two unauthenticated denial-of-service vulnerabilities.

The research states "Our research found that the two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern." They also found that when they scanned SonicWall firewalls with management interfaces exposed to the internet, they found that 76% are vulnerable to one or both issues.

The research can be found here:

It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

Learn more about your ad choices. Visit megaphone.fm/adchoices

Velvet Ant's silent invasion.

Sat, 02 Nov 2024 05:00:00 -0000

This week, we are joined by, Amnon Kushnir from Sygnia, who is sharing their work on "China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day to Deploy Malware on Cisco Nexus Switches." In early 2024, Sygnia observed the ‘Velvet Ant’ threat group exploiting a zero-day vulnerability (CVE-2024-20399) to infiltrate Cisco Switch appliances and operate undetected within enterprise networks.

This attack enables threat actors to escape Cisco’s command interface and install malware directly on the device’s OS, bypassing standard security tools. The incident underscores the risks posed by third-party appliances and the importance of enhanced monitoring and threat detection to counter advanced persistent threats.

The research can be found here:

China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day to Deploy Malware on Cisco Nexus Switches

Learn more about your ad choices. Visit megaphone.fm/adchoices

LLM security 101.

Sat, 26 Oct 2024 05:00:00 -0000

This week, we are pleased to be joined by Mick Baccio, global security advisor for Splunk SURGe, sharing their research on "LLM Security: Splunk & OWASP Top 10 for LLM-based Applications." The research dives into the rapid rise of AI and Large Language Models (LLMs) that initially seem magical, but behind the scenes, they are sophisticated systems built by humans. Despite their impressive capabilities, these systems are vulnerable to numerous cyber threats.

Splunk's research explores the OWASP Top 10 for LLM Applications, a framework that highlights key vulnerabilities such as prompt injection, training data poisoning, and sensitive information disclosure.

The research can be found here:

LLM Security: Splunk & OWASP Top 10 for LLM-based Applications

Learn more about your ad choices. Visit megaphone.fm/adchoices

New targets, new tools, same threat.

Sat, 19 Oct 2024 05:00:00 -0000

This week we are joined by Chester Wisniewski, Global Field CTO from Sophos X-Ops team, to discuss their work on "Crimson Palace returns: New Tools, Tactics, and Targets." Sophos X-Ops has observed a resurgence in cyberespionage activity, tracked as Operation Crimson Palace, targeting Southeast Asian government organizations.

After a brief lull, Cluster Charlie resumed operations in September 2023, using new tactics such as web shells and open-source tools to bypass detection, re-establish access, and map target network infrastructure, demonstrating ongoing efforts to exfiltrate data and expand their foothold.

The research can be found here:

Crimson Palace returns: New Tools, Tactics, and Targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware on repeat.

Sat, 12 Oct 2024 05:00:00 -0000

In this episode, Trevor Hilligoss, VP of SpyCloud Labs at SpyCloud, discusses the increasing threat of ransomware, emphasizing the role of infostealer malware in facilitating these attacks. He draws from SpyCloud's 2024 Malware and Ransomware Defense Report, highlighting how compromised identity data from infostealers creates opportunities for ransomware operators.

With 75% of organizations experiencing multiple ransomware attacks in the past year, Trevor explores findings from over 500 security leaders in the US and UK, discussing the challenges businesses face and how they can use insights from this research to defend against ransomware and other cybercrimes.

The research can be found here:

MALWARE AND RANSOMWARE DEFENSE REPORT

Learn more about your ad choices. Visit megaphone.fm/adchoices

Podcast bait, malware switch.

Sat, 05 Oct 2024 05:00:00 -0000

Joshua Miller from Proofpoint is discussing their work on "Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset." Proofpoint identified Iranian threat actor TA453 targeting a prominent Jewish figure with a fake podcast interview invitation, using a benign email to build trust before sending a malicious link.

The attack attempted to deliver new malware called BlackSmith, containing a PowerShell trojan dubbed AnvilEcho, designed for intelligence gathering and exfiltration. This malware consolidates all of TA453's known capabilities into a single script rather than the previously used modular approach.

The research can be found here:

Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset

Learn more about your ad choices. Visit megaphone.fm/adchoices

Beyond the permissions wall.

Sat, 28 Sep 2024 05:00:00 -0000

We are joined by Yves Younan, Senior Manager, Talos Vulnerability Discovery and Research from Cisco, discussing their work on "How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions." Cisco Talos has uncovered eight vulnerabilities in Microsoft applications for macOS that could allow attackers to exploit the system's permission model by injecting malicious libraries.

By leveraging permissions already granted to these apps, attackers could gain access to sensitive resources like the microphone, camera, and screen recording without user consent. While Microsoft considers these issues low risk and has declined to fix them, the vulnerabilities pose a potential threat to user privacy and security.

The research can be found here:

How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hook, line, and sinker.

Sat, 21 Sep 2024 05:00:00 -0000

Jonathan Tanner, Senior Security Researcher from Barracuda, discussing their work on "Stealthy phishing attack uses advanced infostealer for data exfiltration." The recent phishing attack, detailed by Barracuda, uses a sophisticated infostealer malware to exfiltrate a wide array of sensitive data.

The attack begins with a phishing email containing an ISO file with an HTA payload, which downloads and executes obfuscated scripts to extract and transmit browser information, saved files, and credentials to remote servers. This advanced infostealer is notable for its extensive data collection capabilities and complex exfiltration methods, highlighting the increasing sophistication of cyber threats.

The research can be found here:

Stealthy phishing attack uses advanced infostealer for data exfiltration

Learn more about your ad choices. Visit megaphone.fm/adchoices

Spamageddon: Xeon Sender’s cloudy SMS attack revealed!

Sat, 14 Sep 2024 05:00:00 -0000

Alex Delamotte, Threat Researcher from SentinelOne Labs, joins to share their work on "Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials." SentinelOne’s Labs team has uncovered new research on Xeon Sender, a cloud hacktool used to launch SMS spam attacks via legitimate APIs like Amazon SNS.

First seen in 2022, this tool has been repurposed by multiple threat actors and distributed on underground forums, highlighting the ongoing trend of SMS spam through cloud services and SaaS.

The research can be found here:

Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials

Learn more about your ad choices. Visit megaphone.fm/adchoices

The playbook for outpacing China.

Sat, 07 Sep 2024 05:00:00 -0000

This week, N2K's very own Brandon Karpf sits down with Kevin Lentz, Team Leader of the Cyber Pacific Project at the Global Disinformation Lab, and they discuss the recent threatcasting report "Cyber Competition in the Indo-Pacific Gray Zone 2035." This report, developed using the Threatcasting Method, examines how the U.S. and Indo-Pacific allies can coordinate their cyber defense efforts in response to future competition with China.

It presents findings, trends, and recommendations based on twenty-five scenarios simulated by a cross-functional group of experts to anticipate and address emerging threats over the next decade.

The research can be found here:

Cyber Competition in the Indo-Pacific Gray Zone 2035

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pop goes the developer.

Sat, 31 Aug 2024 05:00:00 -0000

Tim Peck, a Senior Threat Researcher at Securonix, is discussing their work on "Threat actors behind the DEV#POPPER campaign have retooled and are continuing to target software developers via social engineering." The DEV#POPPER campaign continues to evolve, now targeting developers with malware capable of operating on Linux, Windows, and macOS systems.

The threat actors, believed to be North Korean, employ sophisticated social engineering tactics, such as fake job interviews, to deliver stealthy malware that gathers sensitive information, including browser credentials and system data.

The research can be found here:

Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering

Learn more about your ad choices. Visit megaphone.fm/adchoices

MaaS infrastructure exposed.

Sat, 24 Aug 2024 05:00:00 -0000

Robert Duncan, VP of Product Strategy from Netcraft, is discussing their work on "Mule-as-a-Service Infrastructure Exposed." Netcraft's new threat intelligence reveals the intricate connections within global fraud networks, showing how criminals use specialized services like Mule-as-a-Service (MaaS) to launder scam proceeds.

By mapping the cyber and financial infrastructure, including bank accounts, crypto wallets, and phone numbers, Netcraft exposes how different scams are interconnected and identifies weak points that can be targeted to disrupt these operations. This insight provides an opportunity to prevent fraud and protect against financial crimes like pig butchering, investment scams, and romance fraud.

The research can be found here:

Mule-as-a-Service Infrastructure Exposed

Learn more about your ad choices. Visit megaphone.fm/adchoices

Essential tools with critical security challenges.

Sat, 17 Aug 2024 05:00:00 -0000

Snir Ben Shimol from ZEST Security on their work, "How we hacked a cloud production environment by exploiting Terraform providers." In this blog, ZEST discusses the security risks associated with Terraform providers, particularly those from community sources.

The research highlights the importance of carefully vetting providers, regular scanning, and following best practices like version pinning to mitigate potential vulnerabilities in cloud infrastructure management.

The research can be found here:

The hidden risks of Terraform providers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Prompts gone rogue.

Sat, 10 Aug 2024 05:00:00 -0000

Shachar Menashe, Senior Director of Security Research at JFrog, is talking about "When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI." A security vulnerability in the Vanna.AI tool, called CVE-2024-5565, allows hackers to exploit large language models (LLMs) by manipulating user input to execute malicious code, a method known as prompt injection.

This poses a significant risk when LLMs are connected to critical functions, highlighting the need for stronger security measures.

The research can be found here:

When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI

Learn more about your ad choices. Visit megaphone.fm/adchoices

Spinning the web of tangled tactics.

Sat, 03 Aug 2024 05:00:00 -0000

This week, we are joined by Jason Baker, Senior Threat Consultant at GuidePoint Security, and he is discussing their work on "Worldwide Web: An Analysis of Tactics and Techniques Attributed to Scattered Spider." In early 2024, a current RansomHub RaaS affiliate was identified as a former Alphv/Black Cat affiliate and is believed to be linked to the Scattered Spider group, known for using overlapping tools, tactics, and victims.

The high-confidence assessment by GuidePoint’s DFIR and GRIT teams is supported by the consistent use of tools like ngrok and Tailscale, social engineering tactics, and systematic playbooks in intrusions.

The research can be found here:

Worldwide Web: An Analysis of Tactics and Techniques Attributed to Scattered Spider

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Black Basta ransomware riddle.

Sat, 27 Jul 2024 05:00:00 -0000

Dick O'Brien from Symantec Threat Hunter team is talking about their work on "Ransomware Attackers May Have Used Privilege Escalation Vulnerability as Zero-day." Also going to provide some background/history on Black Basta. CVE-2024-26169 in the Windows Error Reporting Service, patched on March 12, 2024, allowed privilege escalation.

Despite initial claims of no active exploitation, recent analysis indicates it may have been exploited as a zero-day before the patch.

The research can be found here:

Ransomware Attackers May Have Used Privilege Escalation Vulnerability as Zero-day

Learn more about your ad choices. Visit megaphone.fm/adchoices

Olympic scammers go for gold.

Sat, 20 Jul 2024 05:00:00 -0000

This week, we are joined by Selena Larson, Staff Threat Researcher, Lead Intelligence Analysis and Strategy at Proofpoint, as well as host of the "Only Malware in the Building" podcast, as she is discussing their research on "Scammers Create Fraudulent Olympics Ticketing Websites." Proofpoint recently identified a fraudulent website selling fake tickets to the Paris 2024 Summer Olympics and quickly suspended the domain.

This site was among many identified by the French Gendarmerie Nationale and Olympics partners, who have shut down 51 of 338 fraudulent websites, with 140 receiving formal notices from law enforcement.

The research can be found here:

Security Brief: Scammers Create Fraudulent Olympics Ticketing Websites

Learn more about your ad choices. Visit megaphone.fm/adchoices

On the prowl for mobile malware.

Sat, 13 Jul 2024 05:00:00 -0000

Active for at least six years, the operation has recently increased its use of mobile malware and commercial spyware for surveillance.

The research can be found here:

Operation Celestial Force employs mobile and desktop malware to target Indian entities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Welcome to New York, it's been waitin' for you.

Sat, 06 Jul 2024 05:00:00 -0000

Joshua Miller from Proofpoint joins Dave to discuss findings on "Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware." In mid May, TA453, also known as Charming Kitten, APT42, Mint Sandstorm, and Yellow Garuda, was found sending a benign conversation lure masquerading as a senior fellow with the Royal United Services Institute (RUSI) to the public media contact for a nuclear security expert at a US-based think tank focused on foreign affairs.

The research states that "the email solicited feedback on a project called “Iran in the Global Security Context” and requested permission to send a draft for review." Proofpoint shares it's findings and what you can expect from the threat group.

The research can be found here:

Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

APT36's cyber blitz on India.

Sat, 29 Jun 2024 05:00:00 -0000

Ismael Valenzuela, Vice President Threat Research & Intelligence, from Blackberry Threat Research and Intelligence team is discussing their work on "Transparent Tribe Targets Indian Government, Defense, and Aerospace Sectors Leveraging Cross-Platform Programming Languages." BlackBerry has identified Transparent Tribe (APT36), a Pakistani-based advanced persistent threat group, targeting India's government, defense, and aerospace sectors from late 2023 to April 2024, using evolving toolkits and exploiting web services like Telegram and Google Drive.

Evidence such as time zone settings and spear-phishing emails with Pakistani IP addresses supports their attribution, suggesting alignment with Pakistan's interests.

The research can be found here:

Transparent Tribe Targets Indian Government, Defense, and Aerospace Sectors Leveraging Cross-Platform Programming Languages

Learn more about your ad choices. Visit megaphone.fm/adchoices

Piercing the through the fog.

Sat, 22 Jun 2024 05:00:00 -0000

Kerri Shafer-Page from Arctic Wolf joins us to discuss their work on "Lost in the Fog: A New Ransomware Threat." Starting in early May, Arctic Wolf's Incident Response team investigated Fog ransomware attacks on US education and recreation sectors, where attackers exploited compromised VPN credentials to access systems, disable Windows Defender, encrypt files, and delete backups.

Despite the uniformity in ransomware payloads and ransom notes, the organizational structure of the responsible groups remains unknown.

The research can be found here:

Lost in the Fog: A New Ransomware Threat

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exploring the mechanics of Infostealer malware.

Sat, 15 Jun 2024 05:00:00 -0000

This week, we are joined by a Security Researcher from SpyCloud Labs, James, who is discussing their work on "Unpacking Infostealer Malware: What we’ve learned from reverse engineering LummaC2 and Atomic macOS Stealer." Infostealer malware has become highly prevalent, with SpyCloud tracking over 50 families and finding that 1 in 5 digital identities are at risk.

This research analyzes the workings and intentions behind infostealers like LummaC2 and Atomic macOS Stealer, focusing on the types of data extracted and the broader security implications.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Riding the hype for new Arc browser.

Sat, 08 Jun 2024 05:00:00 -0000

Jérôme Segura, Senior Director of Threat Intelligence at Malwarebytes, is discussing their work on "Threat actors ride the hype for newly released Arc browser." The Arc browser, newly released for Windows, has quickly garnered positive reviews but has also attracted cybercriminals who are using deceptive Google search ads to distribute malware disguised as the browser.

These malicious campaigns exploit the hype around Arc, using techniques like embedding malware in image files and utilizing the MEGA cloud platform for command and control, highlighting the need for caution with sponsored search results and the effectiveness of Endpoint Detection and Response (EDR) systems.

The research can be found here:

Threat actors ride the hype for newly released Arc browser

Learn more about your ad choices. Visit megaphone.fm/adchoices

1700 IPs and counting.

Sat, 01 Jun 2024 05:00:00 -0000

Amit Malik, Director of Threat Research at Uptycs, is sharing their work on "New Threat Detected: Inside Our Discovery of the Log4j Campaign and Its XMRig Malware." The Uptycs Threat Research Team has discovered a large-scale Log4j campaign involving over 1700 IPs, aiming to deploy XMRig cryptominer malware.

This ongoing operation was initially detected through the team's honeypot collection, prompting an in-depth analysis of the campaign. The research says "The JNDI plugin is particularly useful to attackers because it allows them not only to fetch the values of environment variables in the target system but also to freely define the URL and protocol resource for the JNDI network connection."

The research can be found here:

New Threat Detected: Inside Our Discovery of the Log4j Campaign and Its XMRig Malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

International effort dismantles LockBit.

Sat, 25 May 2024 05:00:00 -0000

Jon DiMaggio, a Chief Security Strategist at Analyst1, is sharing his work on "Ransomware Diaries Volume 5: Unmasking LockBit." On February 19, 2024, the National Crime Agency (NCA), a UK sovereign law enforcement agency, in collaboration with the FBI, Europol, and nine other countries under "Operation Cronos," disrupted the LockBit ransomware gang’s data leak site used for shaming, extorting, and leaking victim data.

The NCA greeted visitors to LockBit’s dark web leak site with a seizure banner, revealing they had been controlling LockBit’s infrastructure for some time, collecting information, acquiring victim decryption keys, and even compromising the new ransomware payload intended for LockBit 4.0.

The research can be found here:

Ransomware Diaries Volume 5: Unmasking LockBit

Learn more about your ad choices. Visit megaphone.fm/adchoices

From secret images to encryption keys.

Sat, 18 May 2024 05:00:00 -0000

This week, we are joined by Hosein Yavarzadeh from the University of California San Diego, as he is discussing his work on "Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor" This paper introduces new methods that let attackers read from and write to specific parts of high-performance CPUs, such as the path history register (PHR) and prediction history tables (PHTs).

These methods allow two main types of attacks. One can reveal a program's control flow history, as shown by recovering a secret image through the libjpeg routines. The other enables detailed transient attacks, demonstrated by extracting an AES encryption key, highlighting significant security risks for these systems.

The research can be found here:

Graph: Growing number of threats leveraging Microsoft API

Learn more about your ad choices. Visit megaphone.fm/adchoices

The double-edged sword of cyber espionage.

Sat, 11 May 2024 05:00:00 -0000

Dick O'Brien from Symantec Threat Hunter team is discussing their research on “Graph: Growing number of threats leveraging Microsoft API.” The team observed an increasing number of threats that have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services.

The research states "the technique was most recently used in an attack against an organization in Ukraine, where a previously undocumented piece of malware used the Graph API to leverage Microsoft OneDrive for C&C purposes."

The research can be found here:

Graph: Growing number of threats leveraging Microsoft API

Learn more about your ad choices. Visit megaphone.fm/adchoices

Geopolitical tensions rise with China.

Sat, 04 May 2024 05:00:00 -0000

Adam Marré, CISO at Arctic Wolf, is diving deep into geopolitical tension with China including APT31, iSoon and TikTok with Dave this week. They also discuss some of the history behind China cyber operations.

Adam shares information on how different APT groups are able to create spear phishing campaigns, and provides info on how to combat these groups.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cerber ransomware strikes Linux.

Sat, 27 Apr 2024 05:00:00 -0000

Christopher Doman, Co-Founder and CTO at Cado Security, is talking about their research on "Cerber Ransomware: Dissecting the three heads." This research delves into Cerber ransomware being deployed onto servers running the Confluence application via the CVE-2023-22518 exploit.

The research states "Cerber emerged and was at the peak of its activity around 2016, and has since only occasional campaigns, most recently targeting the aforementioned Confluence vulnerability."

The research can be found here:

Cerber Ransomware: Dissecting the three heads

Learn more about your ad choices. Visit megaphone.fm/adchoices

The art of information gathering.

Sat, 20 Apr 2024 05:00:00 -0000

Greg Lesnewich, senior threat researcher at Proofpoint, sits down to discuss "From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering." Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails.

The research states "While our researchers have consistently observed TA427 rely on social engineering tactics and regularly rotating its email infrastructure, in December 2023 the threat actor began to abuse lax Domain-based Message Authentication, Reporting and Conformance (DMARC) policies to spoof various personas and, in February 2024, began incorporating web beacons for target profiling."

The research can be found here:

From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering

Learn more about your ad choices. Visit megaphone.fm/adchoices

Breaking down a high-severity vulnerability in Kubernetes.

Sat, 13 Apr 2024 05:00:00 -0000

Tomer Peled, a Security & Vulnerability Researcher from Akamai is sharing their work on "What a Cluster: Local Volumes Vulnerability in Kubernetes." This research focuses on a high-severity vulnerability in Kubernetes, allowing for remote code execution with system privileges on all Windows endpoints within a Kubernetes cluster.

The research states "The discovery of this vulnerability led to the discovery of two others that share the same root cause: insecure function call and lack of user input sanitization."

The research can be found here:

What a Cluster: Local Volumes Vulnerability in Kubernetes

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leaking your AWS API keys, on purpose?

Sat, 06 Apr 2024 05:00:00 -0000

The research can be found here:

What happens when you accidentally leak your AWS API keys? [Guest Diary]

Learn more about your ad choices. Visit megaphone.fm/adchoices

The supply chain in disarray.

Sat, 30 Mar 2024 04:00:00 -0000

Elad, a Senior Security Researcher from Cycode is sharing their research on "Cycode Discovers a Supply Chain Vulnerability in Bazel." This security flaw could let hackers inject harmful code, potentially affecting millions of projects and users, including Kubernetes, Angular, Uber, LinkedIn, Databricks, DropBox, Nvidia, Google, and many more.

The research states "We reported the vulnerability to Google via its Vulnerability Reward Program, where they acknowledged our discovery and proceeded to address and fix the vulnerable components."

Please take a moment to fill out an audience survey! Let us know how we are doing!

The research can be found here:

Cycode Discovers a Supply Chain Vulnerability in Bazel

Learn more about your ad choices. Visit megaphone.fm/adchoices

HijackLoader unleashed: Evolving threats and sneaky tactics.

Sat, 23 Mar 2024 05:00:00 -0000

Liviu Arsene from CrowdStrike joins to discuss their research "HijackLoader Expands Techniques to Improve Defense Evasion." The research has found that HijackLoader continues to become increasingly popular among adversaries for deploying additional payloads and tooling.

In their analysis of a recent HijackLoader sample, CrowdStrike researchers discovered new techniques designed to increase the defense evasion capabilities of the loader. Researchers state "this new approach has the potential to make defense evasion stealthier."

Please take a moment to fill out an audience survey! Let us know how we are doing!

The research can be found here:

HijackLoader Expands Techniques to Improve Defense Evasion

And be sure to join our live webinar: CISOs are the new Architects (of the Workforce)

Join N2K’s Simone Petrella and Intuit’s Kim Jones on Wednesday, March 27th for an online discussion about the pivotal role security leaders play in shaping the security workforce landscape, and how we can start showing up for the future of our industry. Learn more and register on the event page.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Inside SendGrid's phishy business.

Sat, 16 Mar 2024 05:00:00 -0000

Robert Duncan from Netcraft is sharing their research on "Phishception - SendGrid abused to host phishing attacks impersonating itself." Netcraft has recently observed that criminals abused Twilio SendGrid’s email delivery, API, and marketing services to launch a phishing campaign impersonating itself.

Hackers behind this novel phishing campaign used SendGrid’s Tracking Settings feature, which allows users to track clicks, opens, and subscriptions with SendGrid. The malicious link was masked behind a tracking link hosted by SendGrid.

Please take a moment to fill out an audience survey! Let us know how we are doing!

The research can be found here:

Phishception – SendGrid is abused to host phishing attacks impersonating itself

Learn more about your ad choices. Visit megaphone.fm/adchoices

Understanding the multi-tiered impact of ransomware.

Sat, 09 Mar 2024 06:00:00 -0000

This week we are joined by Jamie MacColl and Dr. Pia Hüsch from RUSI discussing their work on "Ransomware: Victim Insights on Harms to Individuals, Organisations and Society." The research reveals some of the harms caused by ransomware, including physical, financial, reputational, psychological and social harms.

Researchers state "Based on interviews with victims and incident responders, this paper outlines the harm ransomware causes to organisations, individuals, the UK economy, national security and wider society."

Please take a moment to fill out an audience survey! Let us know how we are doing!

The research can be found here:

Ransomware: Victim Insights on Harms to Individuals, Organisations and Society

Learn more about your ad choices. Visit megaphone.fm/adchoices

The return of a malware menace.

Sat, 02 Mar 2024 06:00:00 -0000

This week we are joined by, Selena Larson from Proofpoint, who is discussing their research, "Bumblebee Buzzes Back in Black." Bumblebee is a sophisticated downloader used by multiple cybercriminal threat actors and was a favored payload from its first appearance in March 2022 through October 2023 before disappearing.

After a four month hiatus, Proofpoint researchers found that the downloader returned. Its return aligns with a surge of cybercriminal threat activity after a notable absence of many threat actors and malware.

The research can be found here:

Bumblebee Buzzes Back in Black

Learn more about your ad choices. Visit megaphone.fm/adchoices

Web host havoc: Unveiling the Manic Menagerie campaign.

Sat, 24 Feb 2024 06:00:00 -0000

Assaf Dahan and Daniel Frank from Palo Alto Networks Cortex sit down with Dave to talk about their research "Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor." From late 2020 to late 2022, Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union.

The research states "They have further deepened their foothold in victims’ environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites."

The research can be found here:

Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hackers come hopping back.

Sat, 17 Feb 2024 06:00:00 -0000

Ori David from Akamai is sharing their research "Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal." FritzFrog takes advantage of the fact that only internet facing applications were prioritized for Log4Shell patching and targets internal hosts, meaning that a breach of any asset in the network by FritzFrog can expose unpatched internal assets to exploitation.

The research states "FritzFrog has traditionally hopped around by using SSH brute force, and has successfully compromised thousands of targets over the years as a result." Over the years Akamai has seen more than 20,000 FritzFrog attacks, and 1,500+ victims.

The research can be found here:

Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware is coming.

Sat, 10 Feb 2024 06:00:00 -0000

Jon DiMaggio, Chief Security Strategist for Analyst1, is discussing his research on "Ransomware Diaries Volume 4: Ransomed and Exposed - The Story of RansomedVC." While there is evidence to support that RansomedVC runs cybercrime operations, Jon questions the claims it made regarding the authenticity of the data it stole and the methods it used to extort victims.

The research states "I uncovered sensitive information about the group's leader, Ransomed Support (also known as Impotent), relating to secrets from his past." In this episode John shares his 6 key findings after spending months engaging with the lead criminal who runs RansomedVC.

The research can be found here:

Ransomware Diaries Volume 4: Ransomed and Exposed - The Story of RansomedVC

Learn more about your ad choices. Visit megaphone.fm/adchoices

Weathering the internet storm.

Sat, 03 Feb 2024 06:00:00 -0000

Johannes Ullrich from SANS talking about the Internet Storm Center and how they do research. Internet Storm Center was created as a mix of manual reports submitted by security analysts during Y2K and automated firewall collection started by DShield.

The research shares how SANS used their "agile honeypots" to "zoom in" on events to more effectively collect data targeting specific vulnerabilities. Internet Storm Center has been noted on three separate attacks that were observed.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hooked on pirated macOS applications.

Sat, 27 Jan 2024 06:00:00 -0000

Jaron Bradley from Jamf Threat Labs is sharing their work on "Jamf Threat Labs discovers new malware embedded in pirated applications." Jamf Threat Labs has detected a series of pirated macOS applications that have been modified to communicate to attacker infrastructure.

The research states "These applications are being hosted on Chinese pirating websites in order to gain victims." The discovery marks new and advanced malware, similar to the ZuRu malware, first discovered by Objective-See in 2021 within the iTerm2 application.

The research can be found here:

Jamf Threat Labs discovers new malware embedded in pirated applications

Learn more about your ad choices. Visit megaphone.fm/adchoices

A firewall wake up call.

Sat, 20 Jan 2024 06:00:00 -0000

Jon Williams from Bishop Fox is sharing their research on "It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable." SonicWall published advisories for CVE-2022-22274 and CVE-2023-0656 a year apart after finding that NGFW series 6 and 7 devices are affected by two unauthenticated denial-of-service vulnerabilities.

The research can be found here:

It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dual Russian cyber gangs hit 23 companies.

Sat, 13 Jan 2024 06:00:00 -0000

Ryan Westman, Senior Manager, Threat Intelligence, eSentire's Threat Response Unit (TRU), is discussing their research "Two Russian-speaking cyber gangs attack employees from 23 different companies." They are using malicious Google ads, promoting popular business software such as Zoom, Slack, and Adobe.

The customers targeted are companies in the manufacturing, software, legal, retail and healthcare industries. The attacking threat actors belong to the Russian-speaking Malware-as-a-Service (MaaS) groups called BatLoader and FakeBat.

The research can be found here:

Two Competing, Russian-Speaking Cybercrime Groups Attack Employees from 23 Companies in the Manufacturing, Software, Legal, Retail, and Healthcare Sectors Using Malicious Google Ads

Learn more about your ad choices. Visit megaphone.fm/adchoices

Diving deep into Phobos ransomware.

Sat, 06 Jan 2024 06:00:00 -0000

Guilherme Venere from Cisco Talos joins to discuss their research on "A deep dive into Phobos ransomware, recently deployed by 8Base group." Cisco Talos discovered that 8Base’s Phobos ransomware payload contains an embedded configuration, which is a significant difference between 8Base’s Phobos variant and other Phobos samples that have been observed in the wild since 2019.

In this 2-part research series, Talos conducts a deep dive into the Phobos ransomware, including its affiliate structure, activity and capabilities, as well as the one private key that could enable decryption of all the samples analyzed.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: What malicious campaign is lurking under the surface?

Sat, 30 Dec 2023 06:00:00 -0000

Israel Barak, CISO from Cybereason, sits down with Dave to discuss their research, "Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation." Cybereason researchers recently found an attack lurking beneath the surface which was assessed to be the work of Chinese APT Winnti. Cybereason briefed the FBI and the DOJ on the investigation into the malicious campaign.

The research states, "For years, the campaign had operated undetected, siphoning intellectual property and sensitive data." The team quickly made two reports on the campaign, one sharing an examination on the tactics and techniques. The second gives a detailed analysis of the malware and exploits used.

The research can be found here:

Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Compromised military tech?

Sat, 23 Dec 2023 06:00:00 -0000

Dick O'Brien from Symantec's threat hunter team, joins Dave to discuss their work on "Stonefly: North Korea-linked spying operation continues to hit high-value targets." Stonefly specializes in mounting highly selective targeted attacks against targets that could yield intelligence to assist strategically important sectors.

Symantec found that The attackers breached an engineering firm in February 2022, most likely by exploiting the Log4j vulnerability, Their research describes who these high value targets are and ways to prevent this malware from breaching any more companies as well as indications that you could be compromised.

The research can be found here:

Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shedding light on fighting Ursa.

Sat, 16 Dec 2023 06:00:00 -0000

Host of the CyberWire Daily podcast segment Threat Vector, David Moulton sits down with Mike "Siko" Sikorski from Palo Alto Networks Unit 42 to discuss their research on "Fighting Ursa Aka APT28: Illuminating a Covert Campaign."

Unit 42 just published new threat intelligence on Fighting Ursa (aka APT28), a group associated with Russia's military intelligence, on how they are exploiting a Microsoft Outlook vulnerability (CVE-2023-23397) to target organizations in NATO member countries, Ukraine, Jordan, and the UAE. These organizations are of strategic importance in defense, foreign affairs, economy, energy, transportation, and telecommunications.

The research can be found here:

Fighting Ursa Aka APT28: Illuminating a Covert Campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

On the hunt for popping up kernel drives.

Sat, 09 Dec 2023 06:00:00 -0000

Dana Behling, researcher from Carbon Black, sharing their work on "Hunting Vulnerable Kernel Drivers." The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers, six of which allow kernel memory access, accepting firmware access.

TAU reported the issues to the vendors whose drivers had valid signatures at the time of discovery, but only two vendors fixed the vulnerabilities. TAU is calling for more comprehensive approaches in the future than the current banned-list method used by Microsoft. The research states "By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges."

The research can be found here:

Hunting Vulnerable Kernel Drivers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exploits and vulnerabilities.

Sat, 02 Dec 2023 06:00:00 -0000

Ryan from Bishop Fox joins to describe their work on "Building an Exploit for FortiGate Vulnerability CVE-2023-27997." After Lexfo published details of a pre-authentication remote code injection vulnerability in the Fortinet SSL VPN, Bishop Fox worked up a proof of concept demo.

This research share how they were able to create that proof-of-concept exploit, step by step. The researchers state "Our debugging environment consisted of a FortiGate 7.2.4 virtual machine which we modified to disable some self-verification functionality. After bypassing these integrity checks, we were able to install an SSH server, BusyBox, and debugging tools such as GDB."

The research can be found here:

Building an Exploit for FortiGate Vulnerability CVE-2023-27997

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Another infection with new malware.

Sat, 25 Nov 2023 06:00:00 -0000

Larry Cashdollar, Principal Security Intelligence Response Engineer from Akamai Technologies, joins Dave to talk about their research on "KmsdBot: The Attack and Mine Malware." Akamai's Security Research team has found a new malware that infected their honeypot, which they have dubbed KmsdBot.

The research states "The malware attacks using UDP, TCP, HTTP POST, and GET, along with a command and control infrastructure (C2), which communicates over TCP." The botnet targets weak login credentials and then infects systems via an SSH connection.

The research can be found here:

KmsdBot: The Attack and Mine Malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

The malicious YoroTrooper in disguise.

Sat, 18 Nov 2023 06:00:00 -0000

Asheer Malhotra from Cisco Talos discussing their research and findings on "Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan." Cisco Talos' research team, released research attributing the work of the espionage-focused threat actor, YoroTrooper, to individuals based in Kazakhstan.

The research states "YoroTrooper attempts to obfuscate the origin of their operations, employing various tactics to make its malicious activity appear to emanate from Azerbaijan, such as using VPN exit nodes local to that region." They also found that the YoroTrooper continues to rely heavily on phishing emails that direct victims to credential harvesting sites.

The research can be found here:

Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Old malware returns in a new way.

Sat, 11 Nov 2023 06:00:00 -0000

Jeremy Kennelly and Sulian Lebegue from Mandiant sit down with Dave to discuss their research "From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind? One of the oldest and most successful banking fraud malwares, URSNIF, which caused an estimated “tens of millions of dollars in losses”, has been discovered by researchers to have been re-tooled into a generic backdoor, dubbed “LDR4”.

This new variant was first observed in June 2022. Mandiant researchers believe that the same threat actors who operated the RM3 variant of URSNIF are likely behind LDR4. They say "given the success and sophistication RM3 previously had, LDR4 could be a significantly dangerous variant—capable of distributing ransomware—that should be watched closely."

The research can be found here:

From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sandman doesn't slow malware down.

Sat, 04 Nov 2023 05:00:00 -0000

Aleksandar Milenkoski and JAGS from SentinelOne sits down to share their work on "Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit." After observing a new threat activity cluster by an unknown threat actor in August of this year, SentinelLabs dubbed it Sandman.

The research states "Sandman has been primarily targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent." Sandman has deployed a novel modular backdoor utilizing the LuaJIT platform, they call this malware "LuaDream," which exfiltrates system and user information, paving the way for further precision attacks.

The research can be found here:

Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit

Learn more about your ad choices. Visit megaphone.fm/adchoices

No rest for the wicked HiatusRAT.

Sat, 28 Oct 2023 05:00:00 -0000

Danny Adamitis from Lumen's Black Lotus Labs sits down to discuss their work on "No Rest For The Wicked: HiatusRAT Takes Little Time Off In A Return To Action." Last March Lumen's Black Lotus Lab researchers discovered a novel malware called HiatusRAT that targeted business-grade routers.

The research states "In the latest campaign, we observed a shift in reconnaissance and targeting activity; in June we observed reconnaissance against a U.S. military procurement system, and targeting of Taiwan-based organizations." This shift in information gathering and targeting preference exhibited in the latest campaign is synonymous with the strategic interest of the People’s Republic of China according to the 2023 ODNI threat assessment.

The research can be found here:

No Rest For The Wicked: HiatusRAT Takes Little Time Off In A Return To Action

Learn more about your ad choices. Visit megaphone.fm/adchoices

AMBERSQUID hides in the depths.

Sat, 21 Oct 2023 05:00:00 -0000

Sysdig's Alessandro Brucato and Michael Clark join Dave to discuss their work on "AWS's Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation." Attackers are targeting what are typically considered secure AWS services, like AWS Fargate and Amazon SageMaker. This means that defenders generally aren’t as concerned with their security from end-to-end.

The research states "The AMBERSQUID operation was able to exploit cloud services without triggering the AWS requirement for approval of more resources, as would be the case if they only spammed EC2 instances." This poses additional challenges targeting multiple services since it requires finding and killing all miners in each exploited service.

The research can be found here:

AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unwanted guests harvest your information.

Sat, 14 Oct 2023 05:00:00 -0000

Amit Malik from Uptycs joins us to discuss their research titled "Unwanted Guests: Mitigating Remote Access Trojan Infection Risk." Uptycs threat research team identified a new threat referred to as QwixxRAT. The Uptycs team discovered this tool being widely distributed by the threat actor through Telegram and Discord platforms.

The research states "QwixxRAT is meticulously designed to harvest an expansive range of information from browser histories and credit card details, to keylogging insights." This newly found tool poses a risk to both businesses and individual users

The research can be found here:

Unwanted Guests: Mitigating Remote Access Trojan Infection Risk

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targets from DuckTail.

Sat, 07 Oct 2023 05:00:00 -0000

Deepen Desai from Zscaler joins to take a look into their research about "DuckTail." In May of 2023, Zscaler ThreatLabz began an intelligence collection operation to decode DuckTail’s maneuvers. Through an intensive three-month period of monitoring, Zscaler was able obtain unprecedented visibility into DuckTail’s end-to-end operations, spanning the entire kill chain from reconnaissance to post-compromise.

The research states "DuckTail threat actors primarily target users working in the digital marketing and advertising space. Unfortunately, the tech layoffs occurring in 2022 and 2023 introduced more eager candidates into the digital market - meaning more prime targets for DuckTail."

The research can be found here:

A Look Into DuckTail

Learn more about your ad choices. Visit megaphone.fm/adchoices

Downloading cracked software.

Sat, 30 Sep 2023 05:00:00 -0000

David Liebenberg from Cisco Talos joins to discussing Talos' discovery of cracked Microsoft Windows software being downloaded by enterprise users across the globe. Downloading and running this compromised software not only serves as an entry point for threat actors, but can serve as a gateway to access control systems and establish backdoors.

Talos identified additional malware, including RATs, on endpoints running this cracked software, which allows an attacker to gain unauthorized remote access to the compromised system, providing the attacker with various capabilities, such as controlling the system, capturing screenshots, recording keystrokes and exfiltrating sensitive information.

This research article was not published by Cisco Talos' team.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Behind the Google shopping ad masks.

Sat, 23 Sep 2023 05:00:00 -0000

Maxim Zavodchik from Akamai joins Dave to discuss their research on "Xurum: New Magento Campaign Discovered." Akamai researchers have discovered an ongoing server-side template injection campaign that is exploiting digital commerce websites. This campaign targets Magento 2 shops, and was dubbed Xurum in reference to the domain name of the attacker’s command and control (C2) server.

The research states "The attacker uses an advanced web shell named “wso-ng” that is activated only when the attacker sends the cookie “magemojo000” to the backdoor “GoogleShoppingAds” component."

The research can be found here:

Xurum: New Magento Campaign Discovered

Learn more about your ad choices. Visit megaphone.fm/adchoices

A look into the emotions and anxieties of the highest levels of decision-making.

Sat, 16 Sep 2023 05:00:00 -0000

Guest Manuel Hepfer from ISTARI shares his research on cyber resilience which includes discussions with 37 CEOs to gain insight into how they manage cybersecurity risk. ISTARI and Oxford University's Saïd Business School dive into the minds and experiences of CEOs on how they manage cybersecurity risk.

Ask any CEO to name the issues that keep them awake at night and cybersecurity risk is likely near the top of the list – with good reason. With the accelerating digitalisation of business models comes vulnerability to cyberattack. And while spending on cybersecurity increases every year, so does the number of serious incidents. Even the largest and most technologically advanced companies are not immune.

CEOs must formally answer to regulators, shareholders and board members for their organisation’s cybersecurity. Yet the majority (72%) of CEOs we interviewed as part of our research said they were not comfortable making cybersecurity-related decisions.

The research and associated article can be found here:

Research: The CEO Report on Cyber Resilience
Article: Make Cybersecurity a Strategic Asset

Learn more about your ad choices. Visit megaphone.fm/adchoices

No honor in being a criminal.

Sat, 09 Sep 2023 05:00:00 -0000

This week, our guest is Reece Baldwin from Kasada discussing their work on "No Honour Amongst Thieves: Unpacking a New OpenBullet Malware Campaign." The Kasada Threat Intelligence team has recently identified a malware campaign targeting users of OpenBullet, a tool popular within criminal communities to conduct credential stuffing attacks.

This malware campaign was first uncovered when the team was digging around in a Telegram channel setup to share OpenBullet configurations. Reading through a few of the configurations they identified a function, ostensibly designed to bypass Google’s reCAPTCHA anti-bot solution. Th research states "While the versatility of OpenBullet’s configuration files enable complex attacks, they can also make it difficult for inexperienced attackers to fully understand what requests are being created and what data is being retrieved."

The research can be found here:

No Honour Amongst Thieves: Unpacking a New OpenBullet Malware Campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

Thwarting Muddled Libra.

Sat, 02 Sep 2023 05:00:00 -0000

Kristopher Russo and Stephanie Regan from Palo Alto Networks Unit 42 join Dave to talk about Threat Group Assessment: Muddled Libra. With an intimate knowledge of enterprise information technology, this threat group presents a significant risk even to organizations with well-developed legacy cyber defenses.

Posing threats to organizations in the software automation, BPO, telecommunications and technology industries, Muddled Libra is a threat group that favors targeting large outsourcing firms serving high-value cryptocurrency institutions and individuals.

The research can be found here:

Threat Group Assessment: Muddled Libra

Learn more about your ad choices. Visit megaphone.fm/adchoices

Google's not being ghosted from vulnerabilities.

Sat, 26 Aug 2023 05:00:00 -0000

Tal Skverer from Astrix Security joins to discuss their work on "GhostToken – Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts." Astrix’s Security Research Group revealed a 0-day flaw in Google’s Cloud Platform (GCP) on June 19, 2022, which was found to affect all Google users.

The research states "The vulnerability, dubbed “GhostToken”, could allow threat actors to change a malicious application to be invisible and unremovable, effectively leaving the victim’s Google account infected with a trojan app forever." Google issued a patch to this vulnerability in April of this year, but researchers explain why this can be severe.

The research can be found here:

GhostToken – Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts

Learn more about your ad choices. Visit megaphone.fm/adchoices

Politicians targeted by RomCom.

Sat, 19 Aug 2023 05:00:00 -0000

Dmitry Bestuzhev from Blackberry joins to discuss their work on "RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine." Research suggests that the RomCom threat team has been tracked carefully following the geopolitical events surrounding the war in Ukraine, and are now targeting politicians in Ukraine who are working closely with Western countries.

This group is different from others in that their focus is more on secrets or information which can be useful in geopolitics and specifically the war in Ukraine, instead of financial gain. The research says "Although it is unclear at this point what initial infection vector was used to kick off the execution chain, previous RomCom attacks used targeted phishing emails to point a victim to a cloned website hosting Trojanized versions of popular software."

The research can be found here:

RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine

Learn more about your ad choices. Visit megaphone.fm/adchoices

It's raining credentials.

Sat, 12 Aug 2023 05:00:00 -0000

Alex Delamotte from SentinelLabs joins Dave to discuss their work on "Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP." As actors find more ways to profit from compromising services, SentinelLabs finds that cloud service credentials are becoming increasingly targeted.

The lack of threats explicitly targeting Azure and GCP credentials up to this point means there are likely many fresh targets. The research states "These campaigns share similarity with tools attributed to the notorious TeamTNT cryptojacking crew. However, attribution remains challenging with script-based tools, as anyone can adapt the code for their own use."

The research can be found here:

Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP

Learn more about your ad choices. Visit megaphone.fm/adchoices

Who is that stealing my credentials?

Sat, 05 Aug 2023 05:00:00 -0000

Aleksandar Milenkoski from SentinelOne joins to discuss their work on "Kimsuky Strikes Again | New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence." Researchers have been tracking the North Korean APT group Kimsuky and their attempt at a social engineering campaign targeting experts in North Korean affairs.

The research states "The campaign has the objective of stealing Google and subscription credentials of a reputable news and analysis service focusing on North Korea, as well as delivering reconnaissance malware." Kimsuky has been tracked engaging in extensive email correspondence using spoofed URLs and extensive email correspondence, along with Office documents weaponized with the ReconShark malware.

The research can be found here:

Kimsuky Strikes Again | New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing for leeches.

Sat, 29 Jul 2023 05:00:00 -0000

Ashlee Benge from ReversingLabs discussing their research titled "Operation Brainleeches: Malicious npm packages fuel supply chain and phishing attacks." Researchers recently discovered over a dozen malicious packages published to the npm open source repository. These packages are targeting Microsoft 365 users and appear to target application end users while also supporting email phishing campaigns.

Research supports that the malicious campaign encompassed more than a dozen files designed to steal sensitive user credentials. The research states "This most recent campaign caught our attention because of a number of features and characteristics in related npm packages that correlate with malicious intent."

The research can be found here:

Operation Brainleeches: Malicious npm packages fuel supply chain and phishing attacks

Learn more about your ad choices. Visit megaphone.fm/adchoices

Welcome to New York, it's been waitin' for you.

Sat, 22 Jul 2023 05:00:00 -0000

The research can be found here:

Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

SCARLETEEL zaps back again.

Sat, 15 Jul 2023 05:00:00 -0000

Michael Clark from Sysdig joins with Dave to discuss their research on SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. New research from Sysdig threat researchers found that the group continues to thrive with improved tactics. Most recently, they gained access to AWS Fargate, a more sophisticated environment to breach, thanks to their upgraded attack tools.

The research states "In their most recent activities, we saw a similar strategy to what was reported in the previous blog: compromise AWS accounts through exploiting vulnerable compute services, gain persistence, and attempt to make money using cryptominers." Had Sysdig not thwarted SCARLETEEL's attack, they estimated that they would have mined $4,000 per day until they were stopped.

The research can be found here:

SCARLETEEL 2.0: Fargate,Kubernetes, and Crypto

Learn more about your ad choices. Visit megaphone.fm/adchoices

Creating PANDA-monium.

Sat, 08 Jul 2023 05:00:00 -0000

Thomas Etheridge from CrowdStrike sits down to discuss their work on "Business as Usual: Falcon Complete MDR Thwarts Novel VANGUARD PANDA (Volt Typhoon) Tradecraft" In May of 2023, industry and government sources detailed China-nexus activity where they found the threat actor dubbed Volt Typhoon targeted U.S. based critical infrastructure entities. CrowdStrike's Intelligence team tracked this actor as VANGUARD PANDA.

With CISA’s advisory on VANGUARD PANDA and its link to Chinese adversaries who are increasingly targeting US businesses and critical infrastructure, CrowdStrike’s blog dives deeper into the risks of VANGUARD PANDA. The research says "One specific VANGUARD PANDA incident stands out to review in detail. Falcon Complete responded to a detection that was triggered by suspicious reconnaissance commands executed under an Apache Tomcat web server running ManageEngine ADSelfService Plus."

The research can be found here:

Business as Usual: Falcon Complete MDR Thwarts Novel VANGUARD PANDA (Volt Typhoon) Tradecraft

Learn more about your ad choices. Visit megaphone.fm/adchoices

The power behind artificial intelligence.

Sat, 01 Jul 2023 05:00:00 -0000

Daniel dos Santos, Forescout's Head of Security Research is sharing insights from a recent exercise his team conducted on AI-assisted attacks for OT and unmanaged devices. Using ChatGPT, Forescout’s research team converted an existing OT exploit developed in Python to run on Windows to demonstrate how easy it is to create an AI-assisted attack that converts the original exploit into alternative programming languages.

The research states "our goal was to convert an existing OT exploit developed in Python to run on Windows to the Go language using ChatGPT." This would then allow it to run faster on Windows and run easily on a variety of embedded devices.

The research can be found here:

AI-Assisted Attacks Are Coming to OT and Unmanaged Devices – the Time to Prepare Is Now

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unleashing the crypto gold rush.

Sat, 24 Jun 2023 05:00:00 -0000

Ian Ahl from Permiso's PØ Labs joins Dave to discuss their research on "Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor." First observing the group in 2021, they discovered GUI-vil is a financially motivated threat group primarily focused on unauthorized cryptocurrency mining activities.

The research states "the group has been observed exploiting Amazon Web Services (AWS) EC2 instances to facilitate their illicit crypto mining operations." This group is dangerous because unlike many groups focused on crypto mining, GUI-Vil apply a personal touch when establishing a foothold in an environment.

The research can be found here:

Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor

Learn more about your ad choices. Visit megaphone.fm/adchoices

Managing machine learning risks.

Sat, 17 Jun 2023 05:00:00 -0000

Our guest, Johannes Ullrich from SANS Institute, joins Dave to discuss their research on "Machine Learning Risks: Attacks Against Apache NiFi." Using their honeypot network, researchers were able to collect some interesting data about a threat actor who is currently going after exposed Apache NiFi servers.

Researchers state “On May 19th, our distributed sensor network detected a notable spike in requests for ‘/nifi.’” Investigating further, they instructed a subset of their sensors to forward requests to an actual Apache NiFi instance and within a couple of hours the honeypot was completely compromised.

The research can be found here:

Machine Learning Risks: Attacks Against Apache NiFi

Learn more about your ad choices. Visit megaphone.fm/adchoices

A new botnet takes a frosty bite out of the gaming industry.

Sat, 10 Jun 2023 05:00:00 -0000

Our guest, Allen West from Akamai's SIRT team, joins Dave to discuss their research on "The Dark Frost Enigma: An Unexpectedly Prevalent Botnet Author Profile." Akamai found this new botnet was targeting the gaming industry, modeled after Qbot, Mirai, and other malware strains. The botnet has expanded to encompass hundreds of compromised devices.

The research states "through reverse engineering and patching the malware binary, our analysis determined the botnet's attack potential at approximately 629.28 Gbps with its UDP flood attacks." Akamai researchers do a deep dive into the motives behind the attacks, the effectiveness of the attack, and how the law has been handling similar cases.

The research can be found here:

The Dark Frost Enigma: An Unexpectedly Prevalent Botnet Author Profile

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lancefly screams bloody Merdoor.

Sat, 03 Jun 2023 05:00:00 -0000

Brigid O Gorman from Symantec joins Dave to discuss their research, “Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors." Researchers discovered in 2020 that Lancefly, an APT group, is using a custom-written backdoor in attacks targeting government, aviation, educations, and telecoms organizations in South and Southeast Asia.

The research states "The backdoor is used very selectively, appearing on just a handful of networks and a small number of machines over the years, with its use appearing to be highly targeted." These targets, though observed in some activity in 2020 and 2021, started in 2022 and have continued into 2023.

The research can be found here:

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Learn more about your ad choices. Visit megaphone.fm/adchoices

8 GoAnywhere MFT breaches and counting.

Sat, 27 May 2023 05:00:00 -0000

This week, our guests are Emily Austin and Himaja Motheram from Censys and their sharing their research - "Months after first GoAnywhere MFT zero-day attacks, Censys still sees about 180 public admin panels." In early February 2023, Censys researchers discovered a zero-day RCE vulnerability in Fortra’s “GoAnywhere MFT” (Managed File Transfer) software.

After finding this the Clop ransomware gang claimed that they exploited this vulnerability to breach the data of 130 organizations and Censys found other ransomware groups were jumping on the bandwagon. They said " A single vulnerable instance has the potential to serve as a gateway to a data breach that could potentially impact millions of individuals."

The research can be found here:

Months after first GoAnywhere MFT zero-day attacks, Censys still sees ~180 public admin panels

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dangerous vulnerabilities in H.264 decoders.

Sat, 20 May 2023 05:00:00 -0000

Willy R. Vasquez from The University of Texas at Austin discussing research on "The Most Dangerous Codec in the World - Finding and Exploiting Vulnerabilities in H.264 Decoders." Researchers are looking at the marvel that is modern video encoding standards such as H.264 for vulnerabilities and ultimately hidden security risks.

The research states "We introduce and evaluate H26FORGE, domain-specific infrastructure for analyzing, generating, and manipulating syntactically correct but semantically spec-non-compliant video files." Using H26FORCE, they were able to uncover insecurities in depth across the video decoder ecosystem, including kernel memory corruption bugs in iOS and video accelerator and application processor kernel memory bugs in Android devices.

The research can be found here:

The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders

Learn more about your ad choices. Visit megaphone.fm/adchoices

Running away from operation Tainted Love.

Sat, 13 May 2023 05:00:00 -0000

Aleksandar Milenkoski and Juan Andres Guerrero-Saade from SentinelOne's SentinelLabs join Dave to discuss their research "Operation Tainted Love | Chinese APTs Target Telcos in New Attacks." Researchers found initial phases of attacks against telecommunication providers in the Middle East in Q1 in 2023.

The research states "We assess that this activity represents an evolution of tooling associated with Operation Soft Cell." While the exact grouping is unclear, researchers think it is highly likely that the threat actor is a Chinese cyberespionage group in the nexus of Gallium and APT41.

The research can be found here:

Operation Tainted Love | Chinese APTs Target Telcos in New Attacks

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing campaign takes the energy out of Chinese nuclear industry.

Sat, 06 May 2023 05:00:00 -0000

Ryan Robinson from Intezer to discuss his team's work on "Phishing Campaign Targets Chinese Nuclear Energy Industry." The research team discovered activity targeting the nuclear energy industry in China. Researchers attributed the activity to Bitter APT, a South Asian APT that is known to target the energy, manufacturing and government sectors, mainly in Pakistan, China, Bangladesh, and Saudi Arabia.

The article states "We identified seven emails pretending to be from the Embassy of Kyrgyzstan, being sent to recipients in the nuclear energy industry in China. In some emails, people and entities in academia are also targeted, also related to nuclear energy." By luring recipients in, invites them to join conferences on subjects that are relevant to them, they are then able to social engineer the victims.

The research can be found here:

Phishing Campaign Targets Chinese Nuclear Energy Industry

Learn more about your ad choices. Visit megaphone.fm/adchoices

HinataBot focuses on DDoS attack.

Sat, 29 Apr 2023 05:00:00 -0000

This week our guests are, Larry Cashdollar, Chad Seaman and Allen West from Akamai Technologies, and they are discussing their research on "Uncovering HinataBot: A Deep Dive into a Go-Based Threat." The team discovered a new Go-based, DDoS-focused botnet. They found it was named after the popular anime show "Naruto," they are calling it "HinataBot"

In the research it says "HinataBot was seen being distributed during the first three months of 2023 and is actively being updated by the authors/operators." Akamai was able to get a deep look into the malware works by using a combination of reverse engineering the malware and imitating the command and control (C2) server.

The research can be found here:

Uncovering HinataBot: A Deep Dive into a Go-Based Threat

Learn more about your ad choices. Visit megaphone.fm/adchoices

Don't let the Elon Musk crypto giveaway scam swindle you.

Sat, 22 Apr 2023 05:00:00 -0000

Shiran Guez from Akamai sits down with Dave to discuss their research on "Chatbots, Celebrities, and Victim Retargeting and Why Crypto Giveaway Scams Are Still So Successful." Researchers at Akamai have been on the lookout for crypto giveaway scams. These scams have been impersonating celebrities and brands, most notably Elon Musk and his associated companies.

The research states "the scams are delivered through various social media platforms as well as direct messaging apps such as WhatsApp or Telegram." These scams have helped add to the existing damages that exceed $1 billion caused by crypto fraud.

The research can be found here:

Chatbots, Celebrities, and Victim Retargeting: Why Crypto Giveaway Scams Are Still So Successful

Learn more about your ad choices. Visit megaphone.fm/adchoices

New Dero cryptojacking operation concentrates on locating Kubernetes.

Sat, 15 Apr 2023 05:00:00 -0000

Scott Fanning, Senior Director of Product Management, Cloud Security at CrowdStrike, sits down to talk about the first-ever Dero cryptojacking operation targeting Kubernetes infrastructure. The research defines Dero as "a cryptocurrency that claims to offer improved privacy, anonymity and higher and faster monetary rewards compared to Monero, which is a commonly used cryptocurrency in cryptojacking operations."

CrowdStrike was the first organization to discover Dero, and has been observing the cryptojacking operation since the beginning of February 2023. The operation focuses mainly on locating Kubernetes clusters with anonymous access enabled on a Kubernetes API and listening on non-standard ports accessible from the internet.

The research can be found here:

CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes

Learn more about your ad choices. Visit megaphone.fm/adchoices

A dark side to LLMs.

Sat, 08 Apr 2023 05:00:00 -0000

Sahar Abdelnabi from CISPA Helmholtz Center for Information Security sits down with Dave to discuss their work on "A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models." There is currently a large advance in the capabilities of Large Language Models or LLMs, as well as being integrated into many systems, including integrated development environments (IDEs) and search engines.

The research states, "The functionalities of current LLMs can be modulated via natural language prompts, while their exact internal functionality remains implicit and unassessable." This could lead them to be susceptible to targeted adversarial prompting, as well as making them adaptable to even unseen tasks. Researchers demonstrated these said attacks to see if the LLMs needed new techniques for more defense.

The research can be found here:

More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models

Learn more about your ad choices. Visit megaphone.fm/adchoices

Blackfly flies back again.

Sat, 01 Apr 2023 05:00:00 -0000

Dick O'Brien from Symantec’s Threat Hunter team discusses their research on "Blackfly - Espionage Group Targets Materials Technology." Researchers say the Blackfly espionage group (aka APT41), has been mounting attacks against Asian materials and composite organizations in attempts to steal intellectual property.

This group has been known as one of the longest known Chinese advanced persistent threat (APT) groups since at least 2010. The research shares that "early attacks were distinguished by the use of the PlugX/Fast (Backdoor.Korplug), Winnti/Pasteboy (Backdoor.Winnti), and Shadowpad (Backdoor.Shadowpad) malware families."

The research can be found here:

Blackfly: Espionage Group Targets Materials Technology

Learn more about your ad choices. Visit megaphone.fm/adchoices

Popunders are not the good kind of ads.

Sat, 25 Mar 2023 05:00:00 -0000

On this episode, Jérôme Segura, senior threat researcher at Malwarebytes, shares his team's work, "WordPress sites backdoored with ad fraud plugin." WordPress is an immensely popular content management system (CMS) powering over 43% of all websites. Many webmasters will monetize their sites by running ads and need to draw particular attention to search engine optimization (SEO) techniques to maximize their revenues.

The Malwarebytes team discovered a few dozen WordPress blogs using the same plugin that mimics human activity by automatically scrolling a page and following links within it, all the while a number of ads were being loaded and refreshed. The blogs would only exhibit this invalid traffic behavior when launched from a specific URL created by this plugin, otherwise they appeared completely legitimate.

The research can be found here:

WordPress sites backdoored with ad fraud plugin

Learn more about your ad choices. Visit megaphone.fm/adchoices

ChatGPT grants malicious wishes?

Sat, 18 Mar 2023 05:00:00 -0000

Bar Block, Threat Intelligence Researcher at Deep Instinct, joins Dave to discuss their work on "ChatGPT and Malware - Making Your Malicious Wishes Come True." Deep Instinct goes into depth on just how dangerous ChatGPT can be in the wrong hands as well as how artificial intelligence is better at creating malware than providing ways to detect it.

Researchers go on to explain how the AI app can be used in the wrong hands saying "Examples of malicious content created by the AI tool, such as phishing messages, information stealers, and encryption software, have all been shared online."

The research can be found here:

ChatGPT and Malware: Making Your Malicious Wishes Come True

Learn more about your ad choices. Visit megaphone.fm/adchoices

Files stolen from a sneaky SymStealer.

Sat, 11 Mar 2023 06:00:00 -0000

Ron Masas of Imperva discusses their work, the "Google Chrome “SymStealer” Vulnerability. How to Protect Your Files from Being Stolen." By reviewing the ways the browser handles file systems, specifically searching for common vulnerabilities relating to how browsers process symlinks, the Imperva Red Team discovered that when files are dropped onto a file input, it’s handled differently.

Dubbing it as CVE-2022-40764, researchers found a vulnerability that "allowed for the theft of sensitive files, such as crypto wallets and cloud provider credentials." In result, over 2.5 billion users of Google Chrome and Chromium-based browsers were affected.

The research can be found here:

Google Chrome “SymStealer” Vulnerability: How to Protect Your Files from Being Stolen

Learn more about your ad choices. Visit megaphone.fm/adchoices

New exploits are tricking Chrome.

Sat, 04 Mar 2023 06:00:00 -0000

Dor Zvi, Co-Founder and CEO from Red Access to discuss their work on "New Chrome Exploit Lets Attackers Completely Disable Browser Extensions." A recently patched exploit is tricking Chrome browsers on all popular OSs to not only give attackers visibility of their targets’ browser extensions, but also the ability to disable all of those extensions.

The research states the exploit consists of a bookmarklet exploit that allows threat actors to selectively force-disable Chrome extensions using a handy graphical user interface making Chrome mistakenly identify it as a legitimate request from the Chrome Web Store.

The research can be found here:

New Chrome Exploit Lets Attackers Completely Disable Browser Extensions

Learn more about your ad choices. Visit megaphone.fm/adchoices

The next hot AI scam.

Sat, 25 Feb 2023 06:00:00 -0000

Andy Patel from WithSecure Labs joins with Dave to discuss their study that demonstrates how GPT-3 can be misused through malicious and creative prompt engineering. The research looks at how this technology, GPT-3 and GPT-3.5, can be used to trick users into scams.

GPT-3 is a user-friendly tool that employs autoregressive language to generate versatile natural language text using a small amount of input that could inevitably interest cybercriminals. The research is looking for possible malpractice from this tool, such as phishing content, social opposition, social validation, style transfer, opinion transfer, prompt creation, and fake news.

The research can be found here:

Creatively malicious prompt engineering

Learn more about your ad choices. Visit megaphone.fm/adchoices

Implementing and achieving security resilience.

Sat, 18 Feb 2023 06:00:00 -0000

Wendy Nather from Cisco sits down with Dave to discuss their work on "Cracking the Code to Security Resilience: Lessons from the Latest Cisco Security Outcomes Report." The report describes what security resilience is, while also going over how companies can achieve this resilience.

Wendy talks through some of the key findings based off of the report, and after surveying 4,751 active information security and privacy professionals from 26 countries, we find out some of the top priorities to achieving security resilience. From there the research goes on to explain from the findings which data-backed practices lead to the outcomes that can be implemented in cybersecurity strategies.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Knocking down the legs of the industrial security triad.

Sat, 11 Feb 2023 06:00:00 -0000

Pascal Ackerman, OT Security Strategist from Guidepoint Security, joins Dave to discuss his work on discovering a vulnerability in the integrity of common HMI client-server protocol. This research is a Proof of Concept (PoC) attack on the integrity of data flowing across the industrial network with the intention of intercepting, viewing, and even manipulating values sent to (and from) the HMI, ultimately trying to trick the user into making a wrong decision, ultimately affecting the proper operation of the process.

In this research, they are targeting Rockwell Automation’s FactoryTalk View SE products, trying to highlight the lack of integrity and confidentiality on the production network and the effect that has on the overall security of the production environment.

The research can be found here:

GuidePoint Security researcher discovers vulnerability in the integrity of common HMI client-server protocol

Learn more about your ad choices. Visit megaphone.fm/adchoices

Can ransomware turn machines against us?

Sat, 04 Feb 2023 06:00:00 -0000

Tom Bonner and Eoin Wickens from HiddenLayer's SAI Team to discuss their research on weaponizing machine learning models with ransomware. Researchers at HiddenLayer’s SAI Team have developed a proof-of-concept attack for surreptitiously deploying malware, such as ransomware or Cobalt Strike Beacon, via machine learning models.

The attack uses a technique currently undetected by many cybersecurity vendors and can serve as a launchpad for lateral movement, deployment of additional malware, or the theft of highly sensitive data. In this research the team raising awareness by demonstrate how easily an adversary can deploy malware through a pre-trained ML model.

The research can be found here:

WEAPONIZING MACHINE LEARNING MODELS WITH RANSOMWARE

Learn more about your ad choices. Visit megaphone.fm/adchoices

Flagging firmware vulnerabilities.

Sat, 28 Jan 2023 06:00:00 -0000

Roya Gordon from Nozomi Networks sits down with Dave to discuss their research on "Vulnerabilities in BMC Firmware Affect OT/IoT Device Security." Researchers at Nozomi Networks has revealed that there are thirteen vulnerabilities that affect BMCs of Lanner devices based on the American Megatrends (AMI) MegaRAC SP-X.

The research states "By abusing these vulnerabilities, an unauthenticated attacker may achieve Remote Code Execution (RCE) with root privileges on the BMC, completely compromising it and gaining control of the managed host." As well as mentioning what patches could be in the future to help fix these vulnerabilities.

The research can be found here:

Vulnerabilities in BMC Firmware Affect OT/IoT Device Security – Part 1

Learn more about your ad choices. Visit megaphone.fm/adchoices

Billbug infests government agencies.

Sat, 21 Jan 2023 06:00:00 -0000

Brigid O. Gorman from Symantec's Threat Hunter Team joins Dave to discuss their report "Billbug - State-sponsored Actor Targets Cert Authority and Government Agencies in Multiple Asian Countries." The team has discovered that state-sponsored actors compromised a digital certificate authority in an Asian country during a campaign in which multiple government agencies were also targeted.

The research states they believe Billbug, which is a long-established advanced persistent threat (APT) group has been active since about 2009. They say "In activity documented by Symantec in 2019, we detailed how the group was using a backdoor known as Hannotog (Backdoor.Hannotog) and another backdoor known as Sagerunex (Backdoor.Sagerunex). Both these tools were also seen in this more recent activity."

The research can be found here:

Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries

Learn more about your ad choices. Visit megaphone.fm/adchoices

DUCKTAIL waddles back again.

Sat, 14 Jan 2023 06:00:00 -0000

Mohammad Kazem Hassan Nejad from WithSecure joins Dave to discuss the team’s research, “DUCKTAIL returns - Underneath the ruffled feathers.” DUCKTAIL is a financially motivated malware operation that targets individuals and businesses operating on the Facebook Ads and Business platform.

The research states “The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account.” WithSecure has found that after a short hiatus, DUCKTAIL has returned with slight changes in their mode of operation.

The research can be found here:

DUCKTAIL returns: Underneath the ruffled feathers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stealer malware from Russia.

Sat, 07 Jan 2023 06:00:00 -0000

Marisa Atkinson, an analyst from Flashpoint, joins Dave to discuss a new blog post from Flashpoint’s research team about “RisePro” Stealer, malware from Russia, and Pay-Per-Install Malware “PrivateLoader.” “RisePro” is written in C++ and appears to possess similar functionality to the stealer malware “Vidar.” It's also a newly identified stealer, that began appearing as a stealer source for log credentials on the illicit log shop Russian Market on December 13, 2022.

The research states, "Samples that Flashpoint analysts identified indicate that RisePro may have been dropped or downloaded by the pay-per-install malware downloader service “PrivateLoader” in the past year." Analysts identified several sets of logs uploaded to the illicit underground Russian Market, which listed their source as “RisePro.”

The research can be found here:

“RisePro” Stealer and Pay-Per-Install Malware “PrivateLoader”

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: LemonDucks evading detection.

Sat, 31 Dec 2022 06:00:00 -0000

Scott Fanning from CrowdStrike's research team, joins Dave to discuss their work on "LemonDuck Targets Docker for Cryptomining Operations." LemonDuck is a well-known cryptomining botnet, and the research suggests attackers are attracted to the monetary gain from the recent boom in cryptocurrency.

LemonDuck was caught trying to disguise its attack against Docker by running an anonymous mining operation by the use of proxy pools. Scott shares how its unknown which organizations have been targeted and just how much cryptocurrency has been stolen.

The research can be found here:

LemonDuck Targets Docker for Cryptomining Operations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Vulnerabilities in IoT devices.

Sat, 24 Dec 2022 06:00:00 -0000

Dr. May Wang, CTO of IoT Security at Palo Alto Networks, joins Dave Bittner to discuss their findings detailed in Unit 42's "Know Your Infusion Pump Vulnerabilities and Secure Your Healthcare Organization" research. Unit 42 recently set out to better understand how well hospitals and other healthcare providers are doing in securing smart infusion pumps, which are network-connected devices that deliver medications and fluids to patients. This topic is of critical concern because security lapses in these devices have the potential to put lives at risk or expose sensitive patient data.

Unit 42's discovery of security gaps in three out of four infusion pumps that they reviewed highlights the need for the healthcare industry to redouble efforts to protect against known vulnerabilities, while diligently following best practices for infusion pumps and hospital networks. May walks us through Unit 42's work.

The research can be found here:

Know Your Infusion Pump Vulnerabilities and Secure Your Healthcare Organization

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hijacking holiday spirit with phishing scams.

Sat, 17 Dec 2022 06:00:00 -0000

Or Katz from Akamai sits down with Dave to discuss research on highly sophisticated phishing scams and how they are abusing holiday sentiment. This particular threat, most recently has focused on Halloween deals, enticing victims with the chance to win a free prize, including from Dick’s Sporting Goods or Tumi Backpacks. It then requests credit card details to cover the cost of shipment.

From mid-September to the end of October 2022, Akamai's research were able uncover and track this threat. This kit mimics well known retail stores in hopes to hijack credit card information, feeding off of people's holiday spirit.

The research can be found here:

Highly Sophisticated Phishing Scams Are Abusing Holiday Sentiment

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cybersecurity during the World Cup.

Sat, 10 Dec 2022 06:00:00 -0000

AJ Nash from ZeroFox sits down with Dave to discuss Cybersecurity threats including social engineering attacks planned surrounding the Qatar 2022 World Cup. The research shares some of the key threats we might see while the World Cup is happening this year.

Researchers say "During the World Cup, there will likely be threat actors aiming to acquire personal information or monetary value through phishing and scams." In the research we can find how the venue host is preparing for these claims of attacks.

The research can be found here:

Qatar 2022 World Cup Event Assessment

Learn more about your ad choices. Visit megaphone.fm/adchoices

Old malware returns in a new way.

Sat, 03 Dec 2022 06:00:00 -0000

The research can be found here:

From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: The secrets behind Docker.

Sat, 26 Nov 2022 06:00:00 -0000

Alon Zahavi from CyberArk, joins Dave Bittner on this episode to discuss CyberArk's work in conjunction with Patch Tuesday. CyberArk published about how Docker inadvertently created a new vulnerability and what happens when it's exploited.

CyberArk's research concluded that an attacker may execute files with capabilities or setuid files in order to escalate its privileges up to root level. CyberArk found the new vuln in some of Microsoft’s Docker images, caused by misuse of Linux capabilities, a powerful additional layer of security that gives admins the ability to assign capabilities and privileges to processes and files in the Linux system

The research can be found here:

How Docker Made Me More Capable and the Host Less Secure

Learn more about your ad choices. Visit megaphone.fm/adchoices

Another infection with new malware.

Sat, 19 Nov 2022 06:00:00 -0000

The research can be found here:

KmsdBot: The Attack and Mine Malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

An in-depth look on the Crytox ransomware family.

Sat, 12 Nov 2022 06:00:00 -0000

Deepen Desai from Zscaler sits down with Dave to talk about the Crytox ransomware family. First observed in 2020, Crytox is a ransomware family consisting of several stages of encrypted code that has fallen under the radar compared to other ransomware families. While other groups normally use double extortion attacks where data is both encrypted and held for ransom, Crytox does not perform this way.

The research says "The modus operandi of the group is to encrypt files on connected drives along with network drives, drop the uTox messenger application and then display a ransom note to the victim." It also shares how you may be compromised with this ransomware and goes through each stage in depth.

The research can be found here:

Technical Analysis of Crytox Ransomware

Learn more about your ad choices. Visit megaphone.fm/adchoices

Over-the-air 0-day vulnerabilities.

Sat, 05 Nov 2022 05:00:00 -0000

Roya Gordon from Nozomi Networks sits down with Dave to discuss their work "UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice." Ultra-wideband (UWB) is a rapidly-growing radio technology that, according to the UWB Alliance, is forecasted to drive sales volumes exceeding one billion devices annually by 2025.

In an effort to strengthen the security of devices utilizing UWB, Nozomi Networks Labs conducted a security assessment of two popular UWB RTLS solutions available on the market. Their research reveals 0-day vulnerabilities and other weaknesses that, if exploited, could allow an attacker to gain full access to all sensitive location data exchanged over-the-air.

The research can be found here:

UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bugs and working from home.

Sat, 29 Oct 2022 05:00:00 -0000

Federico Kirschbaum from Faraday Security sits down with Dave to discuss their research on "A vulnerability in Realtek's SDK for eCos OS: pwning thousands of routers." The team at Faraday found a vulnerability that made it to DEFCON 30, labeling it high severity. With more and more people working from home for their companies, the research team went looking for where there may be vulnerabilities as employees are working from home.

The research states that the team was "seeking and reporting security vulnerabilities in IoT devices, which led to the finding of an exploitable bug in a consumer-grade router popular in Argentina." They also stated in the research that it was escalating quickly and shares about how protecting home networks is important while working remotely.

The research can be found here:

A vulnerability in Realtek´s SDK for eCos OS: pwning thousands of routers

Learn more about your ad choices. Visit megaphone.fm/adchoices

New tools target governments in Middle East?

Sat, 22 Oct 2022 05:00:00 -0000

Dick O'Brien from Symantec's Threat Hunter team sits down with Dave to discuss their work on "Witchetty - Group Uses Updated Toolset in Attacks on Governments in Middle East." Their research has found that the group known as Witchetty aka LookingFrog, has been progressively updating its toolset, including the new tool, backdoor Trojan (Backdoor.Stegmap) to launch malware attacks on targets in the Middle East and Africa.

The research states "The attackers exploited the ProxyShell and ProxyLogon vulnerabilities to install web shells on public-facing servers before stealing credentials, moving laterally across networks, and installing malware on other computers. The researchers describe more on the new tool being used and why this new group is a threat.

The research can be found here:

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Learn more about your ad choices. Visit megaphone.fm/adchoices

Noberus ransomware: evolving tactics.

Sat, 15 Oct 2022 05:00:00 -0000

Brigid O Gorman from Symantec's Threat Hunter team joins Dave to discuss their research on "Noberus Ransomware - Darkside and BlackMatter Successor Continues to Evolve its Tactics." The research states that Noberus ransomware (aka BlackCat, ALPHV) is more dangerous than ever because attackers have been using new tactics, tools, and procedures in recent months.

In the research, Symantec says, "Among some of the more notable developments has been the use of a new version of the Exmatter data exfiltration tool, and the use of Eamfo, information-stealing malware that is designed to steal credentials stored by Veeam backup software." They go over an in-depth look at how its affiliate program operates.

The research can be found here:

Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics

Learn more about your ad choices. Visit megaphone.fm/adchoices

Google Drive used for malware?

Sat, 08 Oct 2022 05:00:00 -0000

Jen Miller-Osborn from Palo Alto Networks' Unit 42 joins Dave to discuss their work on the Cloaked Ursa group, with a recent report released called "Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive." The research shares insights into an active campaign from Russia’s Foreign Intelligence Service, that is leveraging the use of trusted, legitimate cloud services including Google Drive as a staging platform to deliver malware.

The research states that when these tactics are used, it is extremely difficult for organizations to detect the malicious activity in connection with the campaign. These tactics are used to collect victim information, evade detection, and deliver Cobalt Strike.

The research can be found here:

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targeting your browser bookmarks?

Sat, 01 Oct 2022 05:00:00 -0000

David Prefer from SANS sits down with Dave to discuss how a new covert channel exfiltrates data via a browser's built-in bookmark sync. David goes on to describe how this research will "describe how the ability to synchronize bookmarks across devices introduces a novel vector for data exfiltration and other misuses."

In the research, he shares how he tested his said hypothesis and goes on to describe how the interesting find was tested on multiple browsers including Chrome, Edge, Brave and Opera. In his research, he found that bookmarks are able to keep data and synchronize it, making it easier to infiltrate and extract data from. David shares the rest of his findings, as well as what organizations and browser developers can do to work on this new threat.

The research can be found here:

Bookmark Bruggling: Novel Data Exfiltration with Brugglemark

Learn more about your ad choices. Visit megaphone.fm/adchoices

Keeping an eye on RDS vulnerabilities.

Sat, 24 Sep 2022 05:00:00 -0000

Gafnit Amiga, Director of Security Research from Lightspin, joins Dave to discuss her team's research "AWS RDS Vulnerability Leads to AWS Internal Service Credentials." The research describes how the vulnerability was caught and right after it was reported, the AWS Security team applied an initial patch limited only to the recent Amazon Relational Database Service (RDS) and Aurora PostgreSQL engines, excluding older versions.

They followed by personally reaching out to the customers affected by the vulnerability and helped them through the update process. The research states "Lightspin's Research Team obtained credentials to an internal AWS service by exploiting a local file read vulnerability on the RDS EC2 instance using the log_fdw extension."

The research can be found here:

AWS RDS Vulnerability Leads to AWS Internal Service Credentials

Learn more about your ad choices. Visit megaphone.fm/adchoices

An increase in bypassing bot management?

Sat, 17 Sep 2022 05:00:00 -0000

Sam Crowther, CEO of Kasada join's Dave to discuss their work on "The New Way Fraudsters Bypass Bot Management." Kasada researchers recently discovered a new type of bot called Solver Services, which is used and created by bad actors to bypass the majority of bot management systems.

The research states "Now it’s easier than ever for mainstream bot operators to scrape content, take over accounts, hoard inventory, and commit other forms of automated fraud against organizations using legacy bot management solutions." Attackers are able to buy these “Solver” bots, APIs, and services for less than $500 per month to make a profit.

The research can be found here:

The Emergence of Solver Services: The New Way Fraudsters Bypass Bot Management Vendors

Learn more about your ad choices. Visit megaphone.fm/adchoices

Evilnum APT returns with new targets.

Sat, 10 Sep 2022 05:00:00 -0000

Deepen Desai from Zscaler ThreatLabz joins Dave to discuss their work on "Return of the Evilnum APT with updated TTPs and new targets." Zscaler’s ThreatLabz team recently caught a new Evilnum APT attack campaign that uses the document template on MS Office Word to inject malicious payload to the victim's machine. There are three new instances used of the campaign, including updated tactics, techniques, and procedures.

Researchers have been closely monitoring Evilnum APT’s activity. They ssay ThreatLabz identified several domains associated with the Evilnum APT group. Which has led them to discover that the "group has been successful at flying under the radar and has remained undetected for a long time."

The research can be found here:

Return of the Evilnum APT with updated TTPs and new targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

LockBit's contradiction on encryption speed.

Sat, 03 Sep 2022 05:00:00 -0000

Ryan Kovar from Splunk sits down with Dave to discuss their findings in "Truth in Malvertising?" that contradict the LockBit group's encryption speed claims. Splunk's SURGe team recently released a whitepaper, blog, and video that outlined the encryption speeds of 10 different ransomware families. During their research they cam across Lockbit doing the same thing. After completing the research, the researchers came back to test the veracity of LockBit’s findings.

The research showed three interesting finds. The first find showed that LockBit’s fastest and slowest samples were closely aligned between the tests, but the other results were very different. They also found that LockBit continues to be the fastest ransomware, but LockBit 2.0 was more efficient yet slower than its previous counterpart, LockBit 1.0. Lastly, once ransomware gets to the point of encrypting your systems, it’s too late.

The research can be found here:

Truth in Malvertising?

Learn more about your ad choices. Visit megaphone.fm/adchoices

How a wide scale Facebook campaign stole 1 million credentials.

Sat, 27 Aug 2022 05:00:00 -0000

Nick Ascoli from ForeTrace in a partnership with PIXM sits down with Dave to provide insight on their team's work on "Phishing tactics: how a threat actor stole 1 million credentials in 4 months." During routine analysis, researchers discovered the connection between the pages using PIXM’s deep html analysis feature, which enabled them to view and analyze the underlying code on the pages after they were flagged as phishing. This led to the ensuing investigation, which was led by PIXM’s threat research team with assistance from Nick Ascoli.

The research states "we uncovered a campaign whose scale has potentially impacted hundreds of millions of facebook users, and whose complexity offer insight into the evolving nature of phishing operations, especially from a technical perspective."

The research can be found here:

Phishing tactics: how a threat actor stole 1M credentials in 4 months

Learn more about your ad choices. Visit megaphone.fm/adchoices

Clipminer: Making millions off of malware.

Sat, 20 Aug 2022 05:00:00 -0000

Dick O'Brien from Symantec, a part of Broadcom Software, joins Dave to discuss how the cyber-criminal operation, Clipminer Botnet, makes operators behind it at least $1.7 million. Symantec's research says "The malware being used, tracked as Trojan.Clipminer, has a number of similarities to another crypto-mining Trojan called KryptoCibule, suggesting it may be a copycat or evolution of that threat."

Symantec determined that the malware has the ability to mine for cryptocurrency using compromised computers’ resources. They also share a way to protect against the cyber-criminal operation, as well as sharing some indicators you could be compromised.

The research can be found here:

Clipminer Botnet Makes Operators at Least $1.7 Million

Learn more about your ad choices. Visit megaphone.fm/adchoices

Fake job ads and how to spot them.

Sat, 13 Aug 2022 05:00:00 -0000

Ashley Taylor from SANS.edu, joins Dave to discuss fake job ads and methods to proactively detect these scams. The research shares how job seekers are under attack, with scammers posing as fake job recruiters to steal information from people who are interested in the job posting. The brands being impersonated as are at risk of losing credibility to their brand identity.

The research shares exactly how these doppelgängers are posing a threat to job seekers and the best practices to detect these scams. It also shares how one company that works in medical device manufacturing industry has been a target for these scams. It concludes with sharing some of the ways to proactively spot these scams before they happen.

The research can be found here:

Doppelgängers: Finding Job Scammers Who Steal Brand Identities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Iran-linked Lyceum Group adds a new weapon to its arsenal.

Sat, 06 Aug 2022 05:00:00 -0000

Deepen Desai from Zscaler's ThreatLabz joins Dave to discuss how APTs, like Lyceum Group, create tactics and malware to carry out attacks against their targets. The Lyceum group has been active since 2017 and is a state-sponsored Iranian APT group. This group targets Middle Eastern organizations most notably in the energy and telecommunication sectors, and they rely heavily on .NET based malwares.

Zscaler said in their research they "recently observed a new campaign where the Lyceum Group was utilizing a newly developed and customized .NET based malware targeting the Middle East by copying the underlying code from an open source tool." They go on to give an analysis explaining why the .NET based DNS backdoor is causing problems.

The research can be found here:

Lyceum .NET DNS Backdoor

Learn more about your ad choices. Visit megaphone.fm/adchoices

What malicious campaign is lurking under the surface?

Sat, 30 Jul 2022 05:00:00 -0000

The research can be found here:

Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation

Learn more about your ad choices. Visit megaphone.fm/adchoices

Has GOLD SOUTHFIELD resumed operations?

Sat, 23 Jul 2022 05:00:00 -0000

Rob Pantazopoulos from Secureworks, joins Dave to discuss their work on "REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence." Secureworks researchers published a new analysis on what can be considered the ‘first’ set of ransomware samples associated with the reemergence. These updated samples indicate that GOLD SOUTHFIELD has resumed operations.

The research states "The identification of multiple samples containing different modifications and the lack of an official new version indicate that REvil is under active development." Researchers identified two samples, one in October of 2021, and the other in March of 2022. The March sample has modifications that lead researchers to distinguish the two samples from one another.

The research can be found here:

REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence

Learn more about your ad choices. Visit megaphone.fm/adchoices

A record breaking DDoS attack.

Sat, 16 Jul 2022 05:00:00 -0000

Chad Seaman, Team Lead at Akamai SIRT joins Dave to discuss their research about a record-breaking DDoS Attack. The research says "A new reflection/amplification distributed denial-of-service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks."

Starting in mid-February 2022, security researchers, network operators, and security vendors noticed a spike in DDoS attacks. Researchers started to investigate the spike and determined that the devices that were being abused to launch these attacks are MiCollab and MiVoice Business Express collaboration systems. The research goes into how you can help mitigate the attacks and how Mitel has now released patched software.

The research can be found here:

CVE-2022-26143: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

Learn more about your ad choices. Visit megaphone.fm/adchoices

Information operations during a war.

Sat, 09 Jul 2022 05:00:00 -0000

Alden Wahlstrom, senior analyst on Mandiant's Information Operations Team, shares a comprehensive overview and analysis of the various information operations activities they’ve seen while responding to the Russian invasion. While the full extent of the Russia-Ukraine war has yet to come to light, more than two months after the start of the invasion, Mandiant has identified activity that they believed to be information operations campaigns conducted by actors possibly in support of the political interests of nation-states such as Russia, Belarus, China, and Iran.

The research shares a chart with all of the known information operations events that have taken place so far dating back to January of 2022. It also states that following the beginning of the Russian attack they have seen concerning signs, including "incidents involving the deployment of wiper malware disguised as ransomware."

The research can be found here:

The IO Offensive: Information Operations Surrounding the Russian Invasion of Ukraine

Learn more about your ad choices. Visit megaphone.fm/adchoices

Could REvil have a copycat?

Sat, 02 Jul 2022 05:00:00 -0000

Larry Cashdollar from Akamai, joins Dave to discuss their research on a DDoS campaign claiming to be REvil. The research shares that Akamai's team was notified last week of an attack on one of their hospitality customers that they called "Layer 7" by a group claiming to be associated with REvil. In the research, they dive into the attack, as well as comparing it to other similar attacks that have been made by the group.

The research states "The attacks so far target a site by sending a wave of HTTP/2 GET requests with some cache-busting techniques to overwhelm the website." It also stated that this is a smaller attack than they have seen by the group before, and notes that there seems to be more of a political agenda behind the attack, whereas in the past, REvil has been less political.

The research can be found here:

REvil Resurgence? Or a Copycat?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lazarus Targets Chemical Sector With 'Dream Job.'

Sat, 25 Jun 2022 05:00:00 -0000

Alan Neville, a Threat Intelligence Analyst from Symantec Broadcom, joins Dave to discuss their research "Lazarus Targets Chemical Sector." Symantec has observed the North Korea-linked threat group known as Lazarus conducting an espionage campaign targeting organizations operating within the chemical sector.

The campaign appears to be a continuation of the group's activity called Operation Dream Job, which Symantec first came across in August of 2020. The research states "evidence includes file hashes, file names, and tools that were observed in previous Dream Job campaigns."

The research can be found here:

Lazarus Targets Chemical Sector

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dissecting the Spring4Shell vulnerability.

Sat, 18 Jun 2022 05:00:00 -0000

Edward Wu, senior principal data scientist at ExtraHop, joins Dave to discuss the company's research, "A Technical Analysis of How Spring4Shell Works." ExtraHop first noticed chatter from social media in March of 2022 on a new remote code execution (RCE) vulnerability and immediately started tracking the issue.

In the research, it describes how the exploit works and breaks down how the ExtraHop team came to identify the Spring4Shell vulnerability. The research describes the severity of the vulnerability, saying, "The impact of an RCE in this framework could have a serious impact similar to Log4Shell."

The research can be found here:

How the Spring4Shell Zero-Day Vulnerability Works

Learn more about your ad choices. Visit megaphone.fm/adchoices

New developments in the WSL attack.

Sat, 11 Jun 2022 05:00:00 -0000

Danny Adamitis from Lumen's Black Lotus Labs, joins Dave to discuss new developments in the WSL attack surface. Since September 2021, Black Lotus Labs have been monitoring malware repositories as a part of their proactive threat hunting process. Danny shares how researchers discovered a series of suspicious ELF files compiled for Debian Linux .

The research states how the team identified a series of samples that target the WSL environment, they were uploaded every two to three weeks and started as early as May 3, 2021 and go until August 22, 2021.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

LemonDucks evading detection.

Sat, 04 Jun 2022 05:00:00 -0000

The research can be found here:

LemonDuck Targets Docker for Cryptomining Operations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Compromised military tech?

Sat, 28 May 2022 05:00:00 -0000

The research can be found here:

Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

AutoWarp bug leads to Automation headaches.

Sat, 21 May 2022 05:00:00 -0000

Yanir Tsarimi from Orca Security, joins Dave to discuss how researchers have discovered a critical Azure Automation service vulnerability called AutoWarp. The security flaw was discovered this past March causing Yanir to leap into action announcing the issue to Microsoft who helped to swiftly resolve the cross-account vulnerability.

The research shows how this serious flaw would allow attackers unauthorized access to other customer accounts and potentially full control over resources and data belonging to those accounts, as well as put multiple Fortune 500 companies and billions of dollars at risk. The research shares the crucial time line that the vulnerability was discovered as well as Microsofts response to the vulnerability.

The research can be found here:

AutoWarp: Critical Cross-Account Vulnerability in Microsoft Azure Automation Service

Learn more about your ad choices. Visit megaphone.fm/adchoices

Vulnerabilities in IoT devices.

Sat, 14 May 2022 05:00:00 -0000

The research can be found here:

Know Your Infusion Pump Vulnerabilities and Secure Your Healthcare Organization

Learn more about your ad choices. Visit megaphone.fm/adchoices

Vulnerabilities bring in the hackers.

Sat, 07 May 2022 05:00:00 -0000

Tushar Richabadas from Barracuda joins Dave Bittner to discuss their findings detailed in their "Threat Spotlight: Attacks on Log4Shell vulnerabilities." Their research shows the percentage of attackers targeting the vulnerabilities, and shows where the dips and spikes are over the course of the past couple of months.

The research has also gathered where the attackers main IP addresses are located, with 83% of them located in the United States. They breakdown what this malware can do and how to protect yourself against it. They say "Due to the growing number of vulnerabilities found in web applications, it is getting progressively more complex to protect against attacks."

The research can be found here:

Threat Spotlight: Attacks on Log4Shell vulnerabilities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers coming in from the Backdoor?

Sat, 30 Apr 2022 05:00:00 -0000

Vikram Thakur of Symantec Threat Hunter team joins Dave Bittner to discuss their work on Daxin, a new and the most advanced piece of malware researchers have seen from China-linked actors. Symantec said " There is strong evidence to suggest the malware, Backdoor.Daxin, which allows the attacker to perform various communications and data-gathering operations on the infected computer, has been used as recently as November 2021 by attackers linked to China."

They go on to explain how Daxin is used to target organizations and governments of strategic interest to China and how those agencies can protect themselves. Symantec also discusses how this is the most advanced piece of malware their researchers have seen.

The research can be found here:

Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks

Learn more about your ad choices. Visit megaphone.fm/adchoices

BABYSHARK is swimming again!

Sat, 23 Apr 2022 05:00:00 -0000

John Hammond from Huntress joins Dave Bittner on this episode to discuss malware known as BABYSHARK and how it is swimming out for blood once again. Huntress's research says "This activity aligns with known tradecraft attributed to North Korean threat actors targeting national security think tanks."

Huntress also adds that the activity was spotted on February 16th and immediately their ThreatOps team began following the trail of breadcrumbs. They said "This led them to uncover the malware that was set to target specifically this organization–and certain influential individuals within it."

The research can be found here:

Targeted APT Activity: BABYSHARK Is Out for Blood

Learn more about your ad choices. Visit megaphone.fm/adchoices

A fight to defend Taiwan financial institutions.

Sat, 16 Apr 2022 05:00:00 -0000

Alan Neville from Symantec/Broadcom joins Dave Bittner on this episode to discuss Antlion, a Chinese state-backed hacker group using custom backdoors to target financial institutions in Taiwan. Symantec's blog shares the research behind the attacks and how the backdoor allowed the attackers to run WMI commands remotely.

Symantec's research showed that "The goal of this campaign appears to have been espionage, as we saw the attackers exfiltrating data and staging data for exfiltration from infected networks." They have since found that this attack has been going on over the course of the past 18 months, in which 250 days were spent on the financial organization and around 175 days were spent on the manufacturing organization.

The research can be found here:

Antlion: Chinese APT Uses Custom Backdoor to Target Financial Institutions in Taiwan

Learn more about your ad choices. Visit megaphone.fm/adchoices

The secrets behind Docker.

Sat, 09 Apr 2022 05:00:00 -0000

The research can be found here:

How Docker Made Me More Capable and the Host Less Secure

Learn more about your ad choices. Visit megaphone.fm/adchoices

A popular malware scheme and pay-per-install services.

Sat, 02 Apr 2022 05:00:00 -0000

Guest Michael DeBolt from Intel 471 joins Dave Bittner on this episode to discuss one of the most popular commodity malware loaders on the underground – PrivateLoader. The blog provides an analysis of campaigns since May 2021, full details on a Pay-per-install (PPI) malware service, the methods operators employ to obtain “installs,” and insights on the malware families the service delivers.

On Intel 471's blog, it shows the breakdown of how the PrivateLoader download is delivered and how it works. The blog states "Visitors are lured into clicking a “Download Crack” or “Download Now” button to obtain an allegedly cracked version of the software." Michael explains more about this popular commodity malware loader.

The research can be found here:

PrivateLoader: The first step in many malware schemes

Learn more about your ad choices. Visit megaphone.fm/adchoices

The breakdown of Shuckworm's continued cyber attacks against Ukraine.

Sat, 26 Mar 2022 05:00:00 -0000

Guest Dick O'Brien from Symantec joins Dave Bittner on this episode to discuss how "Shuckworm Continues Cyber-Espionage Attacks Against Ukraine." The Russia-linked Shuckworm group (aka Gamaredon, Armageddon) has been active since 2013 and is known to use phishing emails to distribute either freely available remote access tools.

In July 2021, Symantec observed Shuckworm activity on an organization in Ukraine and this continued until August 2021. According to a November 2021 report from the Security Service of Ukraine (SSU), since 2014 the Shuckworm group has been responsible for over 5,000 attacks against more than 1,500 Ukrainian government systems. Dick walks us through Symantec's investigation.

The research can be found here:

Shuckworm Continues Cyber-Espionage Attacks Against Ukraine

Learn more about your ad choices. Visit megaphone.fm/adchoices

Implications of data leaks of sensitive OT information.

Sat, 19 Mar 2022 05:00:00 -0000

Guest Nathan Brubaker from Mandiant joins Dave Bittner on this episode to discuss Mandiant Threat Intelligence's research: "1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information." Data leaks have always been a concern for organizations. The exposure of sensitive information can result in damage to reputation, legal penalties, loss of intellectual property, and even impact the privacy of employees and customers. However, there is little research about the challenges posed to industrial organizations when threat actors disclose sensitive details about their OT security, production, operations, or technology.

In 2021, Mandiant Threat Intelligence continued observing ransomware operators attempting to extort thousands of victims by disclosing terabytes of stolen information on shaming sites. This trend, which Mandiant Threat Intelligence refers to as “Multifaceted Extortion,” impacted over 1,300 organizations from critical infrastructure and industrial production sectors in just one year. Nathan walks us through their research and findings.

The research can be found here:

1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information

Learn more about your ad choices. Visit megaphone.fm/adchoices

The story of REvil: From origin to beyond.

Sat, 12 Mar 2022 06:00:00 -0000

Guest Jon DiMaggio, Chief Security Strategist at Analyst1, joins Dave Bittner to discuss his team's research "A History of REvil" that chronicles the rise and fall of REvil. The REvil gang is an organized criminal enterprise based primarily out of Russia that runs a Ransomware as a Service (RaaS) operation. The core members of the gang reside and operate out of Russia. REvil leverages hackers for hire, known as affiliates, to conduct the breach, steal victim data, delete backups, and infect victim systems with ransomware for a share of the profits. Affiliates primarily stem across eastern Europe, though a small percentage operate outside that region. In return, the core gang maintains and provides the ransomware payload, hosts the victim data leak/auction site, facilitates victim communication and payment services, and distributes the decryption key. In simpler terms, the core gang are the service provider and persona behind the operation, while the affiliates are the hired muscle facilitating attacks. Jon walks us through the team's findings and details REvil's story.

The research can be found here:

A History of REvil

Learn more about your ad choices. Visit megaphone.fm/adchoices

An abuse of trust: Potential security issues with open redirects.

Sat, 05 Mar 2022 06:00:00 -0000

Guest Mike Benjamin, VP of Security Research at Fastly, joins Dave Bittner to talk about the Fastly Security Research Team's work on "Open redirects: real-world abuse and recommendations." Open URL redirection is a class of web application security problems that makes it easier for attackers to direct users to malicious resources. This vulnerability class, also known as “open redirects,” arises when an application allows attackers to pass information to the app that results in users being sent to another location. That location can be an attacker-controlled website or server used to distribute malware, trick a user into trusting a link, execute malicious code in a trusted way, drive ad fraud, or even perform SEO manipulation. Knowing how an open redirect can be abused is helpful — but knowing how to design around it in the first place is even more important.

Mike walks us through what his team uncovered, explains how redirects are used, how they can be abused, and how you can prevent that abuse.

The research can be found here:

Open redirects: real-world abuse and recommendations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Noberus ransomware: Coded in Rust and tailored to victim.

Sat, 26 Feb 2022 06:00:00 -0000

Guest Dick O'Brien, Principal Editor at Symantec, joins Dave to discuss their team's research, "Noberus: Technical Analysis Shows Sophistication of New Rust-based Ransomware." Noberus is new ransomware used in mid-November attack, ConnectWise was likely infection vector.

Symantec, a division of Broadcom Software, tracks this ransomware as Ransom.Noberus and our researchers first spotted it on a victim organization on November 18, 2021, with three variants of Noberus deployed by the attackers over the course of that attack. This would appear to show that this ransomware was active earlier than was previously reported, with MalwareHunterTeam having told BleepingComputer they first saw this ransomware on November 21.

Noberus is an interesting ransomware because it is coded in Rust, and this is the first time we have seen a professional ransomware strain that has been used in real-world attacks coded in this programming language. Noberus appears to carry out the now-typical double extortion ransomware attacks where they first steal information from victim networks before encrypting files. Noberus adds the .sykffle extension to encrypted files.

The research can be found here:

Noberus: Technical Analysis Shows Sophistication of New Rust-based Ransomware

Learn more about your ad choices. Visit megaphone.fm/adchoices

Instagram hijacks all start with a phish.

Sat, 19 Feb 2022 06:00:00 -0000

Guest Marcelle Lee, Senior Security Researcher and Emerging Threats Lead, from SecureWorks joins Dave to share her team's work on "Ransoms Demanded for Hijacked Instagram Accounts." An extensive phishing campaign has targeted corporate Instagram accounts since approximately August 2021. The threat actors demand ransoms from the victims to restore access.

Organizations typically focus on traditional enterprise cybersecurity threats. However, some threats are more subtle, targeting organizations on unexpected platforms. In October 2021, Secureworks Counter Threat Unit (CTU) researchers identified a phishing campaign that hijacks corporate Instagram accounts, as well as accounts of individual influencers who have a large number of followers. The threat actors then extort ransom payments from the victims. The activity continues at the time of the interview.

The research can be found here:

Ransoms Demanded for Hijacked Instagram Accounts

Learn more about your ad choices. Visit megaphone.fm/adchoices

SysJoker backdoor masquerades as benign updates.

Sat, 12 Feb 2022 06:00:00 -0000

Guests Avigayil Mechtinger and Ryan Robinson from Intezer discuss SysJoker malware, a backdoor that targets Windows, Linux and MacOS, Malware targeting multiple operating systems has become no exception in the malware threat landscape. Vermilion Strike, which was documented just last September, is among the latest examples until now.

In December 2021, the team at Intezer discovered a new multi-platform backdoor that targets Windows, Mac, and Linux. The Linux and Mac versions are fully undetected in VirusTotal. Intezer named this backdoor SysJoker.

SysJoker was first discovered during an active attack on a Linux-based web server of a leading educational institution. After further investigation, Intezer found that SysJoker also has Mach-O and Windows PE versions. Based on Command and Control (C2) domain registration and samples found in VirusTotal, Intezer estimates that the SysJoker attack was initiated during the second half of 2021.

The research can be found here:

New SysJoker Backdoor Targets Windows, Linux, and macOS

Learn more about your ad choices. Visit megaphone.fm/adchoices

The persistent and patient nature of advanced threat actors.

Sat, 05 Feb 2022 06:00:00 -0000

Guest Danny Adamitis from Black Lotus Labs joins Dave to discuss their team's new research "New Konni Campaign Kicks the New Year Off by Targeting Russian Ministry of Foreign Affairs." Black Lotus Labs, the threat research team of Lumen Technologies, uncovered a series of targeted actions against the Russian Federation’s Ministry of Foreign Affairs (MID). Based upon the totality of information available and the close correlation with prior reporting, we assess with moderate confidence these actions leveraged the Konni malware, which has previously been associated with the Democratic People’s Republic of Korea, and were undertaken to establish access to the MID network for the purpose of espionage. This activity cluster demonstrates the patient and persistent nature of advanced actors in waging multi-phased campaigns against perceived high-value networks. After gaining access through stolen credentials, the actor was able to exploit trusted connections to distribute and load the malware, first by impersonating a government software program coinciding with new Covid mandates, and then through sending trojanized files from a compromised account.

The research can be found here:

New Konni Campaign Kicks Off The New Year By Targeting Russian Ministry Of Foreign Affairs

Learn more about your ad choices. Visit megaphone.fm/adchoices

Use of legitimate tools possibly linked to Seedworm.

Sat, 29 Jan 2022 06:00:00 -0000

Guest Sylvester Segura from the Symantec Threat Hunter Team joins Dave to discuss their team's work on "Espionage Campaign Targets Telecoms Organizations across Middle East and Asia." Attackers most likely linked to Iran have attacked a string of telecoms operators in the Middle East and Asia over the past six months, in addition to a number of IT services organizations and a utility company.

Organizations in Israel, Jordan, Kuwait, Saudi Arabia, the United Arab Emirates, Pakistan, Thailand, and Laos were targeted in the campaign, which appears to have made no use of custom malware and instead relied on a mixture of legitimate tools, publicly available malware, and living-off-the-land tactics. While the identity of the attackers remains unconfirmed, there is some evidence to suggest a link to the Iranian Seedworm (aka MuddyWater) group. The targeting and tactics are consistent with Iranian-sponsored actors.

The research can be found here:

Espionage Campaign Targets Telecoms Organizations across Middle East and Asia

Learn more about your ad choices. Visit megaphone.fm/adchoices

A collaboration stumbles upon threat actor Lyceum.

Sat, 22 Jan 2022 06:00:00 -0000

Guest Rob Boyce, Accenture's Global Lead for Cyber Incident Response and Transformation Services, joins Dave to discuss joint research done by Accenture’s Cyber Threat Intelligence (ACTI) group and Prevailion’s Adversarial Counterintelligence Team (PACT). The teams dug into recently publicized campaigns of the cyber espionage threat group Lyceum (aka HEXANE, Spirlin) to further analyze the operational infrastructure and victimology of this actor. The team’s findings corroborate and reinforce previous ClearSky and Kaspersky research indicating a primary focus on computer network intrusion events aimed at telecommunications providers in the Middle East. Additionally, the research expands on this victim set by identifying additional targets within internet service providers (ISPs) and government agencies. Although all victim-identifying information has been redacted, this report seeks to provide these targeted industry and geographic verticals with additional knowledge of the threat and mitigation opportunities.

The research can be found here:

Who are latest targets of cyber group Lyceum?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Keeping APIs on the radar: Evaluating the banking industry.

Sat, 15 Jan 2022 06:00:00 -0000

This episode features guest Alissa Knight, former hacker and partner at Knight Ink, along with Karl Mattson, CISO from Noname Security, discussing findings on severe API vulnerabilities in U.S. banking applications research that was conducted by Alissa and funded by Noname Security. The research, “Scorched Earth: Hacking Bank APIs,” unveils a number of vulnerabilities in the banking, cryptocurrency exchange, and FinTech industries.

In her Money 20/20 keynote presentation entitled “Scorched Earth: Hacking Bank APIs”. In her presentation, Alissa revealed that she was able to gain access to 55 different banks and change PIN codes and move money in and out of accounts. Three lessons learned include: API security vulnerabilities affect all enterprises, API security needs to be operationalized across the enterprise, and API security requires posture management, runtime security, and active testing.

Details can be found here:

White paper: Hacking Banks and Cryptocurrency Exchanges Through Their APIs
Blog post: 3 API Security Lessons from “Scorched Earth: Hacking Bank APIs”
Press release: New Research Shows Vulnerabilities in Banking, Cryptocurrency Exchange, and FinTech APIs Allow Unauthorized Transactions and PIN Code Changes of Customers
Alissa's presentation at Money 20/20.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The rise of Karakurt Hacking Team.

Sat, 08 Jan 2022 06:00:00 -0000

Guest Rob Boyce, Accenture's Global Lead for Cyber Incident Response and Transformation Services, joins Dave to discuss their research "Karakurt rises from its lair." Accenture Security has identified a new threat group, the self-proclaimed Karakurt Hacking Team, that has impacted over 40 victims across multiple geographies. The threat group is financially motivated, opportunistic in nature, and so far, appears to target smaller companies or corporate subsidiaries versus the alternative big game hunting approach. Based on intrusion analysis to date, the threat group focuses solely on data exfiltration and subsequent extortion, rather than the more destructive ransomware deployment. In addition, Accenture Security assesses with moderate-to-high confidence that the threat group’s extortion approach includes steps to avoid, as much as possible, drawing attention to its activities.

The research can be found here:

Karakurt rises from its lair

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: When big ransomware goes away, where should affiliates go?

Sat, 01 Jan 2022 06:00:00 -0000

Our guest Doel Santos, Threat Research Analyst at Palo Alto Networks, joins Dave Bittner to talk about Unit 42's work on "Ransomware Groups to Watch: Emerging Threats." As part of Unit 42’s commitment to stop ransomware attacks, they monitor the activity of existing groups, search for dark web leak sites and fresh onion sites, identify up-and-coming players and study tactics, techniques and procedures. During their operations, Unit 42 observed four emerging ransomware groups that are currently affecting organizations and show signs of having the potential to become more prevalent in the future. Doel discusses these (AvosLocker, Hive Ransomware, HelloKitty, and LockBit 2.0) with Dave.

The research can be found here:

Ransomware Groups to Watch: Emerging Threats

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberWire Pro Research Briefing from 12/21/2021.

Sat, 25 Dec 2021 08:00:00 -0000

Enjoy a peek into CyberWire Pro's Research Briefing as the team is off taking our long winter's nap. This is the spoken edition of our weekly Research Briefing, focused on threats, vulnerabilities, and consequences, as they’re played out in cyberspace. This week's headlines: US Commission on International Religious Freedom reportedly hacked. Sophistication of NSO exploit on par with nation-state tooling. Conti ransomware actors exploit Log4Shell. Like what you hear? Consider subscribing to CyberWire Pro for $99/year. Learn more.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Discovering ChaosDB, a critical vulnerability in the CosmosDB.

Sat, 18 Dec 2021 06:00:00 -0000

Guests Sagi Tzadik and Nir Ohfeld of cloud security company Wiz join Dave to discuss their research "ChaosDB: How we hacked thousands of Azure customers’ databases." Nearly everything we do online these days runs through applications and databases in the cloud. While leaky storage buckets get a lot of attention, database exposure is the bigger risk for most companies because each one can contain millions or even billions of sensitive records. Every CISO’s nightmare is someone getting their access keys and exfiltrating gigabytes of data in one fell swoop.

Database exposures have become alarmingly common in recent years as more companies move to the cloud, and the culprit is usually a misconfiguration in the customer’s environment. In this case, customers were not at fault.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

FIN7 repositioning focus into ransomware.

Sat, 11 Dec 2021 06:00:00 -0000

Guest Ilya Volovik, Team Lead of Cyber Intelligence at Gemini Advisory, discusses his team's work on "FIN7 Recruits Talent For Push Into Ransomware." The cybercriminal group FIN7 gained notoriety in the mid-2010s for large-scale malware campaigns targeting the point-of-sale (POS) systems. In 2018, Gemini Advisory reported FIN7’s compromise of Saks Fifth Avenue and Lord & Taylor stores and the subsequent sale of over 5 million payment cards on the dark web. According to the US Department of Justice, the broader FIN7 carding campaigns have resulted in the theft of over 20 million payment card records and cost victims over $1 billion, making FIN7 one of the most infamous and prolific cybercriminal groups of the last decade. Now with ransomware proving to be cybercriminals’ preferred high-profit, jackpot venture, FIN7 has redeployed their expertise and capacity towards ransomware, with reports indicating that the group was involved in attempted ransomware attacks on US companies as early as 2020. Furthermore, despite focus from law enforcement and the arrest of four FIN7 members from 2018 to 2020, FIN7’s continued activity shows that the group remains a powerful, active threat.

The research can be found here:

FIN7 Recruits Talent For Push Into Ransomware

Learn more about your ad choices. Visit megaphone.fm/adchoices

Getting in and getting out with SnapMC.

Sat, 04 Dec 2021 06:00:00 -0000

Guest Christo Butcher of NCC Group's Research and Intelligence Fusion Team discusses their research into a cybercriminal group they dubbed SnapMC. Forget ransomware, too expensive and too much hassle. Randomly enter through a known vulnerability, take a look around, lock away data and leave again. And all that within half an hour: hit & run. An email is then sent to the affected organization: pay or else the stolen data will be published and/or sold.

This is the opportunistic approach of a new group of blackmailers who don't even bother to encrypt data. NCC Group has given them the name SnapMC: a combination of 'snap' (a sudden, sharp cracking sound or movement) and MC, from mc.exe, the primary tool they use to exfiltrate data. They have only seen SnapMC's attacks in the Netherlands for the time being. They do not target specific sectors and we have not (yet) been able to associate them with known attackers.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberWire Pro Research Briefing from 11/23/2021

Sat, 27 Nov 2021 06:00:00 -0000

Enjoy a peek into CyberWire Pro's Research Briefing as the team is off recovering from our Thanksgiving feasts. This is the spoken edition of our weekly Research Briefing, focused on threats, vulnerabilities, and consequences, as they’re played out in cyberspace. This week's headlines: Iranian threat actors target the IT supply chain. North Korean cyberespionage. More information on Emotet's return. Like what you hear? Consider subscribing to CyberWire Pro for $99/year. Learn more.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Using bidirectionality override characters to obscure code.

Sat, 20 Nov 2021 06:00:00 -0000

Guests Nicholas Boucher and Ross Anderson from the University of Cambridge join Dave Bittner to discuss their research, "Trojan Source: Invisible Vulnerabilities." The researchers present a new type of attack in which source code is maliciously encoded so that it appears different to a compiler and to the human eye. This attack exploits subtleties in text-encoding standards such as Unicode to produce source code whose tokens are logically encoded in a different order from the one in which they are displayed, leading to vulnerabilities that cannot be perceived directly by human code reviewers. ‘Trojan Source’ attacks, as they call them, pose an immediate threat both to first-party software and of supply-chain compromise across the industry. They present working examples of Trojan-Source attacks in C, C++, C#, JavaScript, Java, Rust, Go, and Python. They propose definitive compiler-level defenses, and describe other mitigating controls that can be deployed in editors, repositories, and build pipelines while compilers are upgraded to block this attack.

The project website and research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

A glimpse into TeamTNT.

Sat, 13 Nov 2021 06:00:00 -0000

Senior Intelligence Researcher at Anomali, Tara Gould, joins Dave to discuss their team's work on "Inside TeamTNT’s Impressive Arsenal: A Look Into A TeamTNT Server." Anomali Threat Research discovered an open server to a directory listing that they attribute with high confidence to the German-speaking threat group, TeamTNT. The server contains source code, scripts, binaries, and cryptominers targeting Cloud environments. Other server contents include Amazon Web Services (AWS) Credentials stolen from TeamTNT stealers are also hosted on the server.

This inside view of TeamTNT infrastructure and tools in use can help security operations teams to improve detection capabilities for related attacks, whether coming directly from TeamTNT or other cybercrime groups leveraging their tools.

The research can be found here:

Inside TeamTNT’s Impressive Arsenal: A Look Into A TeamTNT Server

Learn more about your ad choices. Visit megaphone.fm/adchoices

An incident response reveals itself as GhostShell tool, ShellClient.

Sat, 06 Nov 2021 05:00:00 -0000

Guest Mor Levi, Vice President of Cyber Practices from Cybereason, joins Dave Bittner to discuss her team's work on "Operation GhostShell - Novel RAT Targets Global Aerospace and Telecoms Firms." In July 2021, the Cybereason Nocturnus and Incident Response Teams responded to Operation GhostShell, a highly-targeted cyber espionage campaign targeting the Aerospace and Telecommunications industries mainly in the Middle East, with additional victims in the U.S., Russia and Europe.

The Operation GhostShell campaign aims to steal sensitive information about critical assets, organizations’ infrastructure and technology. During the investigation, the Nocturnus Team uncovered a previously undocumented and stealthy RAT (Remote Access Trojan) dubbed ShellClient which was employed as the primary espionage tool. To learn more, listen to the episode.

The research can be found here:

Operation GhostShell - Novel RAT Targets Global Aerospace and Telecoms Firms

Learn more about your ad choices. Visit megaphone.fm/adchoices

Malware sometimes changes its behavior.

Sat, 30 Oct 2021 05:00:00 -0000

Dr. Tudor Dumitras from University of Maryland joins Dave Bittner to share a research study conducted in collaboration with industry partners from Facebook, NortonLifeLock Research Group and EURECOM. The project is called: "When Malware Changed Its Mind: An Empirical Study of Variable Program Behaviors in the Real World." In the study, the team analyzed how malware samples change their behavior when executed on different hosts or at different times. Such “split personalities” may confound the current techniques for malware analysis and detection. Malware execution traces are typically collected by executing the samples in a controlled environment (a “sandbox”), and the techniques created and tested using such traces do not account for the broad range of behaviors observed in the wild. In the paper, the team shows how behavior variability can make those techniques appear more effective than they really are, and they make some recommendations for dealing with the variability.

The research and executive summary can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

When big ransomware goes away, where should affiliates go?

Sat, 23 Oct 2021 05:00:00 -0000

The research can be found here:

Ransomware Groups to Watch: Emerging Threats

Learn more about your ad choices. Visit megaphone.fm/adchoices

Groove Gang making a name for themselves.

Sat, 16 Oct 2021 05:00:00 -0000

Guest Michael DeBolt, Chief Intelligence Officer from Intel471, joins Dave Bittner to discuss their work on "How Groove Gang is shaking up the Ransomware-as-a-Service market to empower affiliates." McAfee Enterprise ATR believes, with high confidence, that the Groove gang is associated with the Babuk gang, either as a former affiliate or subgroup. These cybercriminals are happy to put aside previous Ransomware-as-a-Service hierarchies to focus on the ill-gotten gains to be made from controlling victim’s networks, rather than the previous approach which prioritized control of the ransomware itself.

The research can be found here:

How Groove Gang is shaking up the Ransomware-as-a-Service market to empower affiliates

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taking a closer look at UNC1151.

Sat, 09 Oct 2021 05:00:00 -0000

Matt Stafford, Senior Threat Intelligence Researcher, from Prevailion joins Dave to talk about their work on "Diving Deep into UNC1151’s Infrastructure: Ghostwriter and beyond." Prevailion’s Adversarial Counterintelligence Team (PACT) used advanced infrastructure hunting techniques and Prevailion’s visibility into threat actor infrastructure creation to uncover previously unknown domains associated with UNC1151 and the “Ghostwriter” influence campaign. UNC1151 is likely a state-backed threat actor waging an ongoing and far-reaching influence campaign that has targeted numerous countries across Europe. Their operations typically display messaging in general alignment with the security interests of the Russian Federation; their hallmarks include anti-NATO messaging, intimate knowledge of regional culture and politics, and strategic influence operations (such as hack-and-leak operations used in conjunction with fabricated messaging and/or forged documents). PACT assesses with varying degrees of confidence that there are 81 additional, unreported domains clustered with the activity that FireEye and ThreatConnect detailed in their respective reports. PACT also assesses with High Confidence that UNC1151 has targeted additional European entities outside of the Baltics, Poland, Ukraine and Germany, for which no previous public reporting exists.

The research can be found here:

Diving Deep into UNC1151’s Infrastructure: Ghostwriter and beyond

Learn more about your ad choices. Visit megaphone.fm/adchoices

IoT security and the need for randomness.

Sat, 02 Oct 2021 05:00:00 -0000

Dan Petro, Lead Researcher, and Allan Cecil, Security Consultant, from Bishop Fox join Dave to share their research "You're Doing IoT RNG," that they presented at DefCon 29. There’s a crack in the foundation of Internet of Things (IoT) security, one that affects 35 billion devices worldwide. Basically, every IoT device with a hardware random number generator (RNG) contains a serious vulnerability whereby it fails to properly generate random numbers, which undermines security for any upstream use. In order to perform most security-relevant operations, computers need to generate secrets via an RNG. These secrets then form the basis of cryptography, access controls, authentication, and more. The details of exactly how and why these secrets are generated varies for each use.

The research can be found here:

You're Doing IoT RNG

Learn more about your ad choices. Visit megaphone.fm/adchoices

Vulnerabilities in the public cloud.

Sat, 25 Sep 2021 05:00:00 -0000

Guest Ariel Zelivansky, Senior Manager of Security Research at Palo Alto Networks, joins Dave to discuss Unit 42's work on the first cross-account container takeover in the public cloud. The Unit 42 Threat Intelligence team has identified the first known vulnerability that could enable one user of a public cloud service to break out of their environment and execute code on environments belonging to other users in the same public cloud service. This unprecedented cross-account takeover affected Microsoft's Azure Container-as-a-Service (CaaS) platform. Researchers named the finding Azurescape because the attack started from a container escape – a technique that enables privilege escalation out of container environments.

The research can be found here:

Note: Microsoft is a sponsor of the CyberWire, however, we cover them as we would any other company.

Learn more about your ad choices. Visit megaphone.fm/adchoices

An IoT educational exercise reveals a far-reaching vulnerability.

Sat, 18 Sep 2021 05:00:00 -0000

Guest Jake Valletta, Director of Professional Services at Mandiant, joins Dave to talk about the critical vulnerability Mandiant disclosed that affects millions of IoT devices. Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency (“CISA”) that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020, would enable adversaries to remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.

The research can be found here:

Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Learn more about your ad choices. Visit megaphone.fm/adchoices

A Google Chrome update that just didn't feel right.

Sat, 11 Sep 2021 05:00:00 -0000

Guest Jon Hencinski from Expel joins Dave Bittner to discuss his team's recent work on "Expel SOC Stops Ransomware Attack Aimed at WordPress CMS via Drive-By Download Disguised as Google Chrome Update."

In July, 2021, Expel's SOC stopped a ransomware attack at a large software and staffing company. The attackers compromised the company’s WordPress CMS and used the SocGholish framework to trigger a drive-by download of a Remote Access Tool (RAT) disguised as a Google Chrome update.

In total, four hosts downloaded a malicious Zipped JScript file that was configured to deploy a RAT, but we were able to stop the attack before ransomware deployment and help the organization remediate its WordPress CMS. Jon will walk us through what happened, how they caught it, and provide recommendations on how to secure your WordPress CMS.

The research can be found here:

Expel SOC Stops Ransomware Attack Aimed at WordPress CMS via Drive-By Download Disguised as Google Chrome Update

Learn more about your ad choices. Visit megaphone.fm/adchoices

Like a computer network but for physical objects.

Sat, 04 Sep 2021 05:00:00 -0000

Guest Ben Seri, Armis' VP of Research, joins Dave to talk about a set of remote code execution (RCE) vulnerabilities in the pneumatic tube system of Swisslog. Nine vulnerabilities in critical infrastructure used by 80% of major hospitals in North America.

Swisslog’s Translogic Pneumatic Tube System (PTS), a solution that plays a crucial role in patient care, found vulnerable to devastating attack. Dubbed PwnedPiper, the vulnerabilities allow for complete take over of the Translogic Nexus Control Panel, which powers all current models of Translogic PTS stations. Older IP-connected Translogic stations are also impacted, but are no longer supported by Swisslog.

The research can be found here:

PwnedPiper

Learn more about your ad choices. Visit megaphone.fm/adchoices

Joker malware family: not a joke for Google Play.

Sat, 28 Aug 2021 05:00:00 -0000

Guest Deepen Desai, Zscaler's Chief Information Security Officer and VP Security Research & Operations, joins Dave to discuss their ThreatLabz team's research "Joker Joking in Google Play: Joker malware targets Google Play store with new tactics." Joker is one of the most prominent malware families targeting Android devices. Despite public awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques. This spyware is designed to steal SMS messages, contact lists, and device information, and to sign the victim up for premium wireless application protocol (WAP) services.

Zscaler’s ThreatLabz research team has been constantly monitoring the Joker malware. Recently, they observed regular uploads of it onto the Google Play store. ThreatLabz notified the Google Android Security team, who have taken prompt action to remove the suspicious apps from the Google Play store.

This prompted them to evaluate how Joker is so successful at getting around the Google Play vetting process. The team saw 11 different samples regularly uploaded to Google Play recently clocking 30k installs.

The research can be found here:

Joker Joking in Google Play: Joker malware targets Google Play store with new tactics

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exploring vulnerabilities of off-the-shelf software.

Sat, 21 Aug 2021 05:00:00 -0000

Guest Tomislav Peričin, Reversing Labs' Chief Software Architect and Co-Founder, joins Dave to discuss his team's research that addresses the importance of validating third-party software components as a way to manage the risks that they can introduce. Developing software solutions is a complex task requiring a lot of time and resources. In order to accelerate time to market and reduce the cost, software developers create smaller pieces of functional code which can be reused across many projects. The concept of code reuse is one of the cornerstones of modern software engineering and it is universally accepted that everybody should strive towards it. However, in addition to the positives, organizations need to be aware of the security risks introduced by such third-party components.

The growing number of cyber incidents that target the software supply chain are focused on high-value target compromises. With the latest surge and public uproar, the US President Biden has issued the Executive Order on Improving the Nation’s Cybersecurity in order to create an institutional framework addressing these kinds of security risks.

The research can be found here:

Third-party code comes with some baggage

Learn more about your ad choices. Visit megaphone.fm/adchoices

You can add new features, just secure the old stuff first.

Sat, 14 Aug 2021 05:00:00 -0000

Guests Will Schroeder and Lee Christensen from SpecterOps join Dave to share the research they recently presented at Black Hat USA on the security of Microsoft's Active Directory Certificate Services.

Their abstract:

Microsoft’s Active Directory Public Key Infrastructure (PKI) implementation, known as Active Directory Certificate Services (AD CS), has largely flown under the radar of both the offensive and defensive communities. AD CS is widely deployed, and provides attackers opportunities for credential theft, machine persistence, domain escalation, and subtle domain persistence. We present relevant background on certificates in Active Directory, detail the abuse of AD CS through certificate theft and active malicious enrollments for user and machine persistence, discuss a set of common misconfigurations that can result in domain escalation, and explain a method for stealing a Certificate Authority’s private key in order to forge new user/machine “golden” certificates. By bringing light to the security implications of AD CS, we hope to raise awareness for both attackers and defenders alike of the security issues surrounding this complex, widely deployed, and often misunderstood system.

The blog post and white paper can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

SideCopy malware campaigns expand and evolve.

Sat, 07 Aug 2021 05:00:00 -0000

Guest Asheer Malhotra, Threat Researcher of Cisco Talos Intelligence Group, joins Dave to discuss his team's research "InSideCopy: How this APT continues to evolve its arsenal." Cisco Talos has observed an expansion in the activity of SideCopy malware campaigns, targeting entities in India. In the past, the attackers have used malicious LNK files and documents to distribute their staple C#-based RAT. We are calling this malware "CetaRAT." SideCopy also relies heavily on the use of Allakore RAT, a publicly available Delphi-based RAT.

Recent activity from the group, however, signals a boost in their development operations. Talos has discovered multiple new RAT families and plugins currently used in SideCopy infection chains.

Targeting tactics and themes observed in SideCopy campaigns indicate a high degree of similarity to the Transparent Tribe APT (aka APT36) also targeting India. These include using decoys posing as operational documents belonging to the military and think tanks and honeytrap-based infections.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

China's influence grows through Digital Silk Road Initiative.

Sat, 31 Jul 2021 05:00:00 -0000

Guest Charity Wright, Cyber Threat Intelligence Expert in Recorded Future's Insikt Group, joins Dave to discuss her research "China’s Digital Colonialism: Espionage and Repression Along the Digital Silk Road". Through the Digital Silk Road Initiative (DSR), announced in 2015, the People’s Republic of China (PRC) is building an expansive global data infrastructure and exporting surveillance technologies to dictators and illiberal regimes throughout the developing world, in some cases trading technology for access to sensitive user data and facial recognition intelligence. Domestically, China uses this type of technology to assert authority over its citizens, censor the media, quell protests, and systematically oppress religious minorities. Now, over 80 countries are enabled to do the same with Chinese surveillance technology.

The research can be found here:

China’s Digital Colonialism: Espionage and Repression Along the Digital Silk Road

Learn more about your ad choices. Visit megaphone.fm/adchoices

Free malware with cracked software.

Sat, 24 Jul 2021 05:00:00 -0000

Guest Christopher Budd, Senior Global Threat Communications Manager at Avast, joins Dave to talk about some research his team did when they looked into a Reddit report saying their Avast folder was empty and other reports like it. The team found a new malware they’re calling “Crackonosh” in part because of some possible indications that the malware author may be Czech. Crackonosh is distributed along with illegal, cracked copies of popular software and searches for and disables many popular antivirus programs as part of its anti-detection and anti-forensics tactics.

The research can be found here:

Crackonosh: A New Malware Distributed in Cracked Software

Learn more about your ad choices. Visit megaphone.fm/adchoices

Enabling connectivity enables exposures.

Sat, 17 Jul 2021 05:00:00 -0000

Guest Nathan Howe, Vice President of Emerging Technology at Zscaler, joins Dave to discuss his team's work, "2021 “Exposed” Report Reveals Corporate and Cloud Infrastructures More at Risk Than Ever From Expanded Attack Surfaces." The modern workforce has resulted in an increase of users, devices, and applications existing outside of controlled networks, including corporate networks, the business emphasis on the “network” has decreased and the reliance on the internet as the connective tissue for businesses has increased.

Zscaler analyzes the attack surface of 1,500 organizations and identifies trends affecting businesses of all sizes and industries, across all geographies. Key findings include:

The attack surface impact based on company size
The countries with the greatest attack surface
The industries that are most exposed

The research can be found here:

“Exposed”: The world’s first report to reveal how exposed corporate networks really are.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dealing illicit goods on encrypted chat apps.

Sat, 10 Jul 2021 05:00:00 -0000

Guest Daniel Kats, Senior Principal Research Engineer at NortonLifeLock, joins Dave to discuss his team's work, "Encrypted Chat Apps Doubling as Illegal Marketplaces." Encrypted chat apps are gaining popularity worldwide due to their central premise of not sending user data to tech giants. Some popular examples include WhatsApp, Telegram and Signal. These apps have also been adopted by businesses to securely communicate directly to their users. Additionally, these apps have been instrumental to subverting authoritarian regimes.

However, NortonLifeLock found that encrypted chat apps are also being used by criminals to sell illegal goods. Because content moderation is, by design, nearly impossible on these apps, they allow for an easy vector for dealers of illicit goods to communicate directly to customers without fear of law enforcement involvement.

The research can be found here:

Encrypted Chat Apps Doubling as Illegal Marketplaces

Learn more about your ad choices. Visit megaphone.fm/adchoices

Malware in pirated Windows installation files.

Sat, 03 Jul 2021 05:00:00 -0000

Guest Tom Roter from Minera Labs joins Dave to discuss his team research: "Rigging a Windows Installation." It is common knowledge that pirated software might contain malware, yet millions still put themselves and their devices at risk and download from dubious sources. It is even more surprising to see the popularity of torrented operating system installations, which are ranked at the top of most torrent tracker ranking lists. Today we will prove conventional wisdom right and show off a devious, yet clever attack chain employed by an infected Windows 10 image, frequently shared and downloaded by tens of thousands of users.

Over the last year, numerous malicious PowerShell events popped up in our telemetry. The events caught our attention because a payload was being downloaded into the “C:\Windows” directory, which is usually well guarded under NTFS permissions, this implies that the attacker had very high privilege on the compromised system.

The research can be found here:

Rigging a Windows installation

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exhibiting advanced APT-like behavior.

Sat, 26 Jun 2021 05:00:00 -0000

Guest Yonatan Striem-Amit joins Dave to talk about Cybereason's research "Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities." The Cybereason Nocturnus Team responded to several incident response (IR) cases involving infections of the Prometei Botnet against companies in North America, observing that the attackers exploited recently published Microsoft Exchange vulnerabilities (CVE-2021-27065 and CVE-2021-26858) in order to penetrate the network and install malware. Yonatan shares his team's findings of the investigation of the attacks, including the initial foothold sequence of the attackers, the functionality of the different components of the malware, the threat actors’ origin and the bot’s infrastructure.

The research can be found here:

Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Primitive Bear spearphishes for Ukrainian entities.

Sat, 19 Jun 2021 05:00:00 -0000

Guests Gage Mele and Yury Polozov join Dave to talk about Anomali's research "Primitive Bear (Gamaredon) Targets Ukraine with Timely Themes." Anomali Threat Research identified malicious samples that align with the Russia-sponsored cyberespionage group Primitive Bear’s (Gamaredon, Winterflounder) tactics, techniques, and procedures (TTPs). Primitive Bear, known primarily to focus on Ukraine, has been very active in 2021. However, the themes of the samples Anomali found, as well as those shared by the security community, could also be used to target multiple former Union of Soviet Socialist Republic (USSR) countries. Anomali Threat Research found malicious .docx files being distributed by Primitive Bear, likely through spearphishing, that attempted to download remote template .dot files through template injection.

The research can be found here:

Primitive Bear (Gamaredon) Targets Ukraine with Timely Themes

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taking a look behind the Science of Security.

Sat, 12 Jun 2021 05:00:00 -0000

Guest Adam Tagert is a Science of Security (SoS) Researcher in the National Security Agency Research Directorate. The National Security Agency (NSA) sponsors the Science of Security (SoS) Initiative for the promotion of a foundational cybersecurity science that is needed to mature the cybersecurity discipline and to underpin advances in cyberdefense. Adam works in all aspects of SoS particularly in the promotion of collaboration and use of foundational cybersecurity research. He promotes rigorous research methods by leading the Annual Best Scientific Cybersecurity Paper Competition. Adam joins Dave Bittner to discuss the NSA's SoS Initiative and their Science of Security and Privacy 2021 Annual Report.

Information on the SoS Initiative and the report can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bad building blocks: a new and unusual phishing campaign.

Sat, 05 Jun 2021 05:00:00 -0000

Guest Karl Sigler of Trustwave's SpiderLabs joins Dave Bittner to talk about their research: "Hidden Phishing at Free JavaScript Site". The research describes an interesting phishing campaign SpiderLabs encountered recently. In this campaign, the email subject pertains to a price revision, followed by some numbers. There is no email body, but there is an attachment about an ”investment.” The attachment’s convoluted filename contains characters the file-naming convention doesn’t allow, notably the vertical stroke, “|.” Even though "xlsx" is in the filename, double-clicking the attachment will prompt the user to open it with the default web browser. Thus, the file indeed appears to be an HTML document. Of course, it’s malicious.

The research can be found here:

HTML Lego: Hidden Phishing at Free JavaScript Site

Learn more about your ad choices. Visit megaphone.fm/adchoices

EtterSilent: a popular, versatile maldoc builder.

Sat, 29 May 2021 05:00:00 -0000

Guest Brandon Hoffman of Intel 471 joins Dave Bittner to share his team's research "EtterSilent: the underground’s new favorite maldoc builder". The cybercrime underground often mimics behaviors that we see in everyday facets of life. Intel 471’s latest discovery is an example of one of these patterns: when a product takes off in the marketplace, users will rush to obtain it and find unique ways to use it in order to fit their needs.

The latest “product” is a malicious document builder, known in the underground as “EtterSilent,” that Intel 471 has seen leveraged by various cybercrime groups. As it has grown in popularity, it has constantly been updated in order to avoid detection. Used in conjunction with other forms of malware, it’s a prime example of how ease of use and a concentration of skill sets leads to a commoditization of the cybercrime economy.

EtterSilent: the underground’s new favorite maldoc builder

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leveraging COVID-19 themes for malicious purposes.

Sat, 22 May 2021 05:00:00 -0000

Guest Joe Slowik joins us from DomainTools to discuss his team's research "COVID-19 Phishing With a Side of Cobalt Strike." Multiple adversaries, from criminal groups to state-directed entities, engaged in malicious cyber activity using COVID-19 pandemic themes since March 2020. Adversaries continue to leverage the pandemic, arguably the most significant issue globally as of this writing, in various ways. Yet the most persistent avenue remains using COVID-19 themes for building malicious document files. Examples include lures associated with Cloud Atlas-linked activity and broader targeting of health authorities.

Given the continued significance of the pandemic and persistent use of pandemic themes by adversaries, DomainTools researchers continuously monitor for items leveraging COVID-19 content for malicious purposes. While conducting this research, DomainTools analysts identified an interesting malicious document with what appeared to be unique staging and execution mechanisms.

Research can be found here:

COVID-19 Phishing With a Side of Cobalt Strike

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jack Voltaic: critical infrastructure resiliency project, not a person.

Sat, 15 May 2021 05:00:00 -0000

Guest LTC Erica Mitchell from Army Cyber Institute joins us to talk about their infrastructure resiliency research project called Jack Voltaic. The Army Cyber Institute’s (ACI’s) Jack Voltaic (JV) project enables the institute to study incident response gaps alongside assembled partners to identify interdependencies among critical infrastructure and provide recommendations. JV provides an innovative, bottom‐up approach to critical infrastructure resilience in two unique ways. Whereas most federal efforts to improve resiliency focus on regional or multistate emergency response, JV focuses on cities and municipalities where critical infrastructure and populations are most heavily populated. Furthermore, JV deviates from other cybersecurity and national preparedness exercises in that it builds around areas of interest nominated by the participants. Although JV events include national-level capabilities and resources, they are conceptually driven by the concerns of the cities and their infrastructure partners. Through this approach, the ACI, the Army, and the Department of Defense (DoD) are able to harvest insights about potential roles, dependencies, partners, and support requests, while cities are able to discover potential capability gaps and expand their critical infrastructure information-sharing networks before a potential disaster strikes.

Research links:

Learn more about your ad choices. Visit megaphone.fm/adchoices

SUPERNOVA activity and its possible connection to SPIRAL threat group.

Sat, 08 May 2021 05:00:00 -0000

Guest Mike McLellan from Secureworks joins us to share his team's insights about SUPERNOVA and threat group attribution. Similarities between the SUPERNOVA activity and a previous compromise of the network suggest that SPIRAL was responsible for both intrusions and reveal information about the threat group.

In late 2020, Secureworks® Counter Threat Unit™ (CTU) researchers observed a threat actor exploiting an internet-facing SolarWinds server to deploy the SUPERNOVA web shell. Additional analysis revealed similarities to intrusion activity identified on the same network earlier in 2020, suggesting the two intrusions are linked. CTU™ researchers attribute the intrusions to the SPIRAL threat group. Characteristics of the activity suggest the group is based in China.

The research can be found here:

SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group

Learn more about your ad choices. Visit megaphone.fm/adchoices

A snapshot of the ransomware threat landscape.

Sat, 01 May 2021 05:00:00 -0000

Guest Jen Miller-Osborn from Palo Alto Networks' Unit 42 joins Dave to discuss their 2021 Unit 42 Ransomware Threat Report, which highlights a surge in ransomware demands based on a global analysis of the threat landscape in 2020. To evaluate the current state of the ransomware threat landscape, the Unit 42 threat intelligence team and the Crypsis incident response team collaborated to analyze the ransomware threat landscape in 2020, with global data from Unit 42 as well as US, Canada, and Europe data from Crypsis. The report details the top ransomware variants, average ransomware payments, ransomware predictions, and actionable next steps to immediately reduce ransomware risk.

The report can be found here:

2021 Unit 42 Ransomware Threat Report

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bulletproof hosting (BPH) and how it powers cybercrime.

Sat, 24 Apr 2021 05:00:00 -0000

Guest Jason Passwaters of Intel 471 joins us to discuss his team's research into bulletproof hosting (BPH). The research team at Intel 471 defined what a typical BPH service offers and how these services can be stopped in order to limit the damage they have on enterprises, businesses and digital society itself. They examined some popular malware families that actors host or leverage via BPH services. While much more goes into a cybercriminal’s full operation, it would be vastly more difficult to pull off without the ability to host malware and be free from impunity. Finally, they listed of some of the BPH providers that are firmly entrenched in the cybercrime underground and how they give support to other cybercriminal enterprises. By recognizing their behaviors, security teams can begin to take measures to figure out who the actors are, how they operate and what their infrastructure looks like. By doing so, organizations can begin to uncover ways to proactively counter maliciously-used infrastructure before criminals have a chance to launch their attacks.

The blog posts can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Social engineering: MINEBRIDGE RAT embedded to look like job résumés.

Sat, 17 Apr 2021 05:00:00 -0000

Guest Deepen Desai joins Dave to talk about Zsaler's research "Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures." In Jan 2021, Zscaler ThreatLabZ discovered new instances of the MINEBRIDGE remote-access Trojan (RAT) embedded in macro-based Word document files crafted to look like valid job resumes (CVs). Such lures are often used as social engineering schemes by threat actors.

MINEBRIDGE buries itself into the vulnerable remote desktop software TeamViewer, enabling the threat actor to take a wide array of remote follow-on actions such as spying on users or deploying additional malware.The use of social engineering tactics targeting security teams appears to be on an upward trend.

The research can be found here:

Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures

Learn more about your ad choices. Visit megaphone.fm/adchoices

Strategic titles point to something more than a commodity campaign.

Sat, 10 Apr 2021 05:00:00 -0000

Guests Gage Mele, Winston Marydasan, and Yury Polozov from Anomali join Dave to discuss their research into Static Kitten targeting government agencies in the UAE and Kuwait. Anomali Threat Research uncovered malicious activity very likely attributed to the Iran-nexus cyberespionage group, Static Kitten (Seedworm, MERCURY, Temp.Zagros, POWERSTATS, NTSTATS, MuddyWater), which is known to target numerous sectors primarily located in the Middle East This new campaign, which uses tactics, techniques, and procedures (TTPs) consistent with previous Static Kitten activity, uses ScreenConnect launch parameters designed to target any MOFA with mfa[.]gov as part of the custom field. Anomali's team found samples specifically masquerading as the Kuwaiti government and the UAE National Council respectively, based on references in the malicious samples.

The research can be found here:

Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ezuri: Regenerating a different kind of target.

Sat, 03 Apr 2021 05:00:00 -0000

Guests Fernando Martinez and Tom Hegel from AT&T Alien Labs join Dave to discuss their team's research "Malware using new Ezuri memory loader." Multiple threat actors have recently started using a Go language (Golang) tool to act as a packer and avoid Antivirus detection. Additionally, the Ezuri memory loader tool acts as a malware loader and executes its payload in memory, without writing the file to disk. While this technique is known and commonly used by Windows malware, it is less popular in Linux environments.

The research can be found here:

Malware using new Ezuri memory loader

Learn more about your ad choices. Visit megaphone.fm/adchoices

How are we doing in the industrial sector?

Sat, 27 Mar 2021 05:00:00 -0000

Guest Sergio Caltagirone from Dragos joins us to take us through their 2020 ICS Cybersecurity Year in Review report. Dragos's annual ICS Year in Review provides an overview and analysis of ICS vulnerabilities, global threat activity targeting industrial environments, and industry trends and observations gathered from customer engagements worldwide. The goal of the report is to give asset owners and operators proactive, actionable information and defensive recommendations in order to prepare for and combat the world’s most significant industrial cybersecurity adversaries.

The report can be found here:

2020 ICS CYBERSECURITY YEAR IN REVIEW

Learn more about your ad choices. Visit megaphone.fm/adchoices

BendyBear: difficult to detect and downloader of malicious payloads.

Sat, 20 Mar 2021 05:00:00 -0000

Guest Jen Miller-Osborn from Palo Alto Networks' Unit 42 joins us to discuss their research into BendyBear. Highly malleable, highly sophisticated and over 10,000 bytes of machine code. The code behavior and features strongly correlate with that of the WaterBear malware family, which has been active since as early as 2009. The malware is associated with the cyber espionage group BlackTech, which many in the broader threat research community have assessed to have ties to the Chinese government, and is believed to be responsible for recent attacks against several East Asian government organizations. Due to the similarities with WaterBear, and the polymorphic nature of the code, Unit 42 named this novel Chinese shellcode “BendyBear.” It stands in a class of its own in terms of being one of the most sophisticated, well-engineered and difficult-to-detect samples of shellcode employed by an Advanced Persistent Threat (APT).

The research can be found here:

BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech

Learn more about your ad choices. Visit megaphone.fm/adchoices

Keeping data confidential with fully homomorphic encryption.

Sat, 13 Mar 2021 06:00:00 -0000

Guest Dr. Rosario Cammarota from Intel Labs joins us to discuss confidential computing. Confidential computing provides a secure platform for multiple parties to combine, analyze and learn from sensitive data without exposing their data or machine learning algorithms to the other party. This technique goes by several names — multiparty computing, federated learning and privacy-preserving analytics, among them. Confidential computing can enable this type of collaboration while preserving privacy and regulatory compliance.

The research and supporting documents can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Diving deep into North Korea's APT37 tool kit.

Sat, 06 Mar 2021 06:00:00 -0000

Guest Hossein Jazi of Malwarebytes joins us to take a deep dive into North Korea's APT37 (aka ScarCruft, Reaper and Group123) toolkit. On December 7 2020 the Malwarebytes Labs threat team identified a malicious document uploaded to Virus Total which was purporting to be a meeting request likely used to target the government of South Korea. The meeting date mentioned in the document was 23 Jan 2020, which aligns with the document compilation time of 27 Jan 2020, indicating that this attack took place almost a year ago.

The file contains an embedded macro that uses a VBA self decoding technique to decode itself within the memory spaces of Microsoft Office without writing to the disk. It then embeds a variant of the RokRat into Notepad.

Based on the injected payload, the Malwarebytes team believes that this sample is associated with APT37. This North Korean group is also known as ScarCruft, Reaper and Group123 and has been active since at least 2012, primarily targeting victims in South Korea.

The research can be found here:

Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shining a light on China's cyber underground.

Sat, 27 Feb 2021 06:00:00 -0000

Guest Maurits Lucas from Intel471 joins us to discuss his team's research into cybercrime in China. Data from Intel 471 show that the Chinese cybercrime underground proliferates through use of common methods or platforms, but behaves differently in large part due to the caution that actors take with regard to their identity. While the average citizen must follow the heavy handed nature of the government’s surveillance of cyberspace, Chinese threat actors take special precautions to protect their forums, TTPs and themselves. This leads to the Chinese cybercrime underground being disorderly when compared to others, particularly Russia, which tend to be much more organized.

The research can be found here:

No pandas, just people: The current state of China’s cybercrime underground

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers (ab)using Google Chrome.

Sat, 20 Feb 2021 06:00:00 -0000

Guest Bojan Zdrnja of Infigo IS and a certified instructor at SANS Institute shares an incident he discovered where attackers were using a pretty novel way of exfiltrating data and using that channel for C&C communication. The code that was acquired was only partially recovered, but enough to indicate powerful features that the attackers were (ab)using in Google Chrome. The basis for this attack were malicious extensions that the attacker dropped on the compromised system.

The research can be found here:

Abusing Google Chrome extension syncing for data exfiltration and C&C

Learn more about your ad choices. Visit megaphone.fm/adchoices

Using the human body as a wire-like communication channel.

Sat, 13 Feb 2021 06:00:00 -0000

Guest Dr. Shreyas Sen, a Perdue University associate professor of electrical and computer engineering, joins us to discuss the following scenario:. Instead of inserting a card or scanning a smartphone to make a payment, what if you could simply touch the machine with your finger? A prototype developed by Purdue University engineers would essentially let your body act as the link between your card or smartphone and the reader or scanner, making it possible for you to transmit information just by touching a surface.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

"Follow the money" the cybersecurity way.

Sat, 06 Feb 2021 06:00:00 -0000

Guest Joe Slowik joins us from Domain Tools to share their research "Current Events to Widespread Campaigns: Pivoting from Samples to Identify Activity" where they examined technical artifacts emerging around the 2020 conflict between Armenia and Azerbaijan in the Caucasus region.

Cyber Threat Intelligence (CTI) practitioners can gain insight into adversary operations by tracking conflicts or geopolitical tensions. Similar to a “follow the money” approach in criminal investigations, looking at conflict zones can reveal cyber capabilities deployed as part of events —either by the parties to the conflict itself, or third parties interested in monitoring events for their own purposes.

Based on precedent, analysts can identify developments in adversary operations and technical capabilities by tracking identifiers related to major events and conflict zones. Identifying capabilities deployed to take advantage of such items can yield insights into fundamental attacker tradecraft and behaviors, and enable defense and response for incidents which may strike far closer to home at a later date.

The research can be found here:

Current Events to Widespread Campaigns: Pivoting from Samples to Identify Activity

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Kimsuky group from North Korea expands spyware, malware and infrastructure.

Sat, 30 Jan 2021 06:00:00 -0000

Guest Yonatan Striem-Amit joins us from Cybereason to share their Nocturnus Team research into Kimsuky. The Cybereason Nocturnus Team has been tracking various North Korean threat actors, among them the cyber espionage group known as Kimsuky, (aka: Velvet Chollima, Black Banshee and Thallium), which has been active since at least 2012 and is believed to be operating on behalf of the North Korean regime. The group has a rich and notorious history of offensive cyber operations around the world, including operations targeting South Korean think tanks, but over the past few years they have expanded their targeting to countries including the United States, Russia and various nations in Europe.

The research can be found here:

Back to the Future: Inside the Kimsuky KGH Spyware Suite

Learn more about your ad choices. Visit megaphone.fm/adchoices

Trickbot may be down, but can we count it out?

Sat, 23 Jan 2021 06:00:00 -0000

Guest Mark Arena from Intel471 joins us to discuss his team's research into Trickbot and its evolution from a banking trojan to a long-standing, most likely well-resourced operation that was taken down last year. Mark shares some insight into Trickbot's order of operations and what went on behind the scenes that his team working with Brian Krebs were able to discover.

Since the separate and independent actions taken against Trickbot, Intel471 has observed successful disruption of its command and control infrastructure. However, the actors linked to Trickbot have not ceased their criminal activities. These actors have continued engaging in ransomware activity, using BazarLoader instead of Trickbot. Intel471 is unable to assess the long-term impact of the Trickbot disruption activity or whether Trickbot will continue to be used by cybercrime groups. This analysis covers the period from Sept. 22, 2020 until Nov. 6, 2020.

The research can be found here:

Trickbot down, but is it out?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Manufacturing sector is increasingly a target for adversaries.

Sat, 16 Jan 2021 06:00:00 -0000

Guest Selena Larson, senior cyber threat analyst at Dragos, Inc., joins us to discuss their research into recent observations of ICS-targeting threats to manufacturing organizations.

Cyber risk to the manufacturing sector is increasing, led by disruptive cyberattacks impacting industrial processes, intrusions enabling information gathering and process information theft, and new activity from Industrial Control Systems (ICS)-targeting adversaries. Dragos currently publicly tracks five ICS-focused activity groups targeting manufacturing: CHRYSENE, PARISITE, MAGNALLIUM, WASSONITE, and XENOTIME in addition to various ransomware activities capable of disrupting operations.

Manufacturing relies on ICS to scale, function, and ensure consistent quality control and product safety. It provides crucial materials, products, and medicine and is classified as critical infrastructure. Due to the interconnected nature of facilities and operations, an attack on a manufacturing entity can have ripple effects across the supply chain that relies on timely and precise production to support product fulfillment, health and safety, and national security objectives.

Ransomware adversaries are adopting ICS-aware functionality with the ability to stop industrial related processes and cause disruptive – and potentially destructive – impacts. Dragos has not observed ICS-specific malware targeting manufacturing operations on the same scale or sophistication as that used in the disruptive TRISIS and CRASHOVERRIDE malware attacks that targeted energy operations in Saudi Arabia and Ukraine, respectively. However, known and ongoing threats to manufacturing can have direct and indirect impact to operations. This report provides a snapshot of the threat landscape as of October 2020 and is expected to change in the future as adversaries and their behaviors evolve.

The research can be found here:

ICS Threat Activity on the Rise in Manufacturing Sector

Learn more about your ad choices. Visit megaphone.fm/adchoices

Emotet reemerges and becomes one of most prolific threat groups out there.

Sat, 09 Jan 2021 06:00:00 -0000

Deep Instinct's Shimon Oren joins us to talk about his team's research on "Why Emotet's latest wave is harder to catch than ever before - Part 2." Emotet appears to have reemerged more evasive than before, this time with a payload delivered from a loader that security tools aren’t equipped to handle.

Emotet, the largest malware botnet today, started in 2014 and continues to be one of the most challenging threats in today’s landscape. This botnet causes huge damage by spreading ransomware and info stealers to its infected systems. Recently, a rise in the number of Emotet infections was observed in France, Japan, and New Zealand. The high number of infections shows the effectiveness of the Emotet malware at staying undetected.

Shimon joins us to discuss how Deep Instinct investigated the payload that was encrypted inside the loader, analyzes the next steps in the infection process, and discovers the techniques used to make this malware difficult to analyze.

The original blog post and updated post on the research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Unpacking the Malvertising Ecosystem. [Research Saturday]

Sat, 02 Jan 2021 06:00:00 -0000

Researchers at Cisco's Talos Unit recently published research exploring the tactics, technics and procedures of the global malvertising ecosystem. Craig Williams is head of Talos Outreach at Cisco, and he guides us through the life cycle of malicious online ads, along with tips for protecting yourself and your organization.

The research can be found here:

https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Seedworm digs Middle East intelligence. [Research Saturday]

Sat, 26 Dec 2020 06:00:00 -0000

Researchers at Symantec have been tracking Seedworm, a cyber espionage group targeting the Middle East as well as Europe and North America. The threat group targets government agencies, oil & gas facilities, NGOs, telecoms and IT firms.

Al Cooley is director of product management at Symantec, and he joins us to share their findings.

The original research can be found here:

https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

Learn more about your ad choices. Visit megaphone.fm/adchoices

Advertising Software Development Kit (SDK): serving up more than just in-app ads and logging sensitive data.

Sat, 19 Dec 2020 06:00:00 -0000

On August 24, 2020, Snyk announced the discovery of suspicious behaviors in the iOS version of a popular advertising SDK known as Mintegral. At that time, they had confirmed with partners in the advertising attribution space that at minimum, Mintegral appeared to be using this functionality to gather large amounts of data and commit ad attribution fraud. Their research showed that Mintegral was using code obfuscation and method swizzling to modify the functionality of base iOS SDK methods without the application owner’s knowledge. Further, their research proved that Mintegral was logging all HTTP requests including its headers which could even contain authorization tokens or other sensitive data.

Since that time Mintegral announced that they were opening the source of their SDK to the market. While the SDK can only be downloaded by registered partners, a major game publisher shared the source code with Snyk for further analysis. They also continued their research by digging deeper into the Android versions of the SDK in which they hadn’t found similar behaviors at the time of the initial disclosure.

This has resulted in some significant discoveries that necessitate an update to the previous disclosure. Additionally, Mintegral and the community at large have responded to the situation, and Snyk felt a summary of the events was a good way to finalize their research into this SDK.

Joining us on Research Saturday to discuss their research is Snyk's Alyssa Miller.

The original blog and Snyk's update can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Following DOJ indictment, a look back on NotPetya and Olympic Destroyer research.

Sat, 12 Dec 2020 06:00:00 -0000

From US Department of Justice: "On Oct. 15, 2020, a federal grand jury in Pittsburgh returned an indictment charging six computer hackers, all of whom were residents and nationals of the Russian Federation (Russia) and officers in Unit 74455 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency of the General Staff of the Armed Forces.

These GRU hackers and their co-conspirators engaged in computer intrusions and attacks intended to support Russian government efforts to undermine, retaliate against, or otherwise destabilize: (1) Ukraine; (2) Georgia; (3) elections in France; (4) efforts to hold Russia accountable for its use of a weapons-grade nerve agent, Novichok, on foreign soil; and (5) the 2018 PyeongChang Winter Olympic Games after Russian athletes were banned from participating under their nation’s flag, as a consequence of Russian government-sponsored doping effort.

Their computer attacks used some of the world’s most destructive malware to date, including: KillDisk and Industroyer, which each caused blackouts in Ukraine; NotPetya, which caused nearly $1 billion in losses to the three victims identified in the indictment alone; and Olympic Destroyer, which disrupted thousands of computers used to support the 2018 PyeongChang Winter Olympics. The indictment charges the defendants with conspiracy, computer hacking, wire fraud, aggravated identity theft, and false registration of a domain name."

Returning to Research Saturday this week to discuss their research of NotPetya and Olympic Destroyer are Cisco Talos' Craig Williams and Matt Olney.

The indictment and Cisco's research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

SSL-based threats remain prevalent and are becoming increasingly sophisticated.

Sat, 05 Dec 2020 06:00:00 -0000

While SSL/TLS encryption is the industry standard for protecting data in transit from prying eyes, encryption has, itself, become a threat. It is often leveraged by attackers to sneak malware past security tools that do not fully inspect encrypted traffic. As the percentage of traffic that is encrypted continues to grow, so do the opportunities for attackers to deliver threats through encrypted channels.

To better understand the use of encryption and the volume of encrypted traffic that is inspected, Zscaler's research team, ThreatLabZ, analyzed encrypted traffic across the Zscaler cloud for the first nine months of 2020, assessing its use within specific industries. The study also set out to analyze the types of attacks that use encryption and the extent of the current risk.

Returning to Research Saturday this week to discuss the report is Zscaler's CISO and VP of Security Research, Deepen Desai.

The research can be found here:

2020: The State of Encrypted Attacks Blog
2020: The State of Encrypted Attacks Report

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Using global events as lures for malicious activity.

Sat, 28 Nov 2020 06:00:00 -0000

The goal of malicious activity is to compromise the system to install some unauthorized software. Increasingly that goal is tied to one thing: the user. Over the past several years, we as an industry improved exploit mitigation and the value of working exploits has increased accordingly. Together, these changes have had an impact on the threat landscape. We still see large amounts of active exploitation, but enterprises are getting better at defending against them.

This has left adversaries with a couple of options, develop or buy a working exploit that will defeat today's protections, which can be costly, or pivot to enticing a user to help you. In today's threat landscape, adversaries are always trying to develop and implement the most effective lures to try and draw users into their infection path. They've tried a multitude of different tactics in this space, but one always stands out — current events.

Joining us on this week's Research Saturday from Craig Williams from Cisco's Talos Outreach team to walk us through how current events are used as lures.

The research and blog post can be found here:

Adversarial use of current events as lures

Learn more about your ad choices. Visit megaphone.fm/adchoices

Misconfigured identity and access management (IAM) is much more widespread.

Sat, 21 Nov 2020 06:00:00 -0000

Identity and access are intrinsically connected when providing security to cloud platforms. But security is only effective when environments are properly configured and maintained. In the 2H 2020 edition of the biannual Unit 42 Cloud Threat Report, researchers conducted Red Team exercises, scanned public cloud data and pulled proprietary Palo Alto Networks data to explore the threat landscape of identity and access management (IAM) and identify where organizations can improve their IAM configurations.

During a Red Team exercise, Unit 42 researchers were able to discover and leverage IAM misconfigurations to obtain admin access to a customer’s entire Amazon Web Services (AWS) cloud environment – a potentially multi-million dollar data breach in the real-world. These examples highlight just how serious the failure to secure IAM can be for an organization.

Joining us in this week's Research Saturday to discuss the report for Palo Alto Networks' Unit 42 is CSO of Public Cloud, Matt Chiodi.

The research can be found here:

Highlights from the Unit 42 Cloud Threat Report, 2H 2020

Learn more about your ad choices. Visit megaphone.fm/adchoices

That first CVE was a fun find, for sure.

Sat, 14 Nov 2020 06:00:00 -0000

In the late 90s, hackers who discovered vulnerabilities would sometimes send an email to Bugtraq with details. Bugtraq was a notification system used by people with an interest in network security. It was also a place that might have been monitored by employees of software companies looking for reports of vulnerabilities pertaining to their software. The problem was - there wasn't an easy way to track specific vulnerabilities in specific products.

It was May 1999. Larry Cashdollar was working as a system administrator for Bath Iron Works under contract by Computer Sciences Corporation. Specifically, he was a UNIX Systems Administrator, level one. His team managed over 3,000 UNIX systems across BIW's campuses. Most of these were CAD systems used for designing AEGIS class destroyers. This position gave me access to over 3,000 various flavors of UNIX ranging from Sun Solaris to IBM AIX.

Joining us in this week's Research Saturday to discuss his journey from finding that first CVE through the next 20 years and hundreds of CVEs is Akamai Senior Response Engineer Larry Cashdollar.

The research can be found here:

MUSIC TO HACK TO: MY FIRST CVE AND 20 YEARS OF VULNERABILITY RESEARCH

Learn more about your ad choices. Visit megaphone.fm/adchoices

PoetRAT: a complete lack of operational security.

Sat, 07 Nov 2020 06:00:00 -0000

Cisco Talos discovered PoetRAT earlier this year. Since then, they observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. They assess with medium confidence this actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. They currently believe the malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document. These Word documents continue to contain malicious macros, which in turn download additional payloads once the attacker sets their sites on a particular victim. As the geopolitical tensions grow in Azerbaijan with neighboring countries, this is no doubt a stage of espionage with national security implications being deployed by a malicious actor with a specific interest in various Azerbajiani government departments.

Joining us in this week's Research Saturday to discuss the research from Cisco's Talos Outreach is Craig Williams.

The research can be found here:

PoetRAT: Malware targeting public and private sector in Azerbaijan evolves

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leveraging for a bigger objective.

Sat, 31 Oct 2020 05:00:00 -0000

The U.S. government has charged seven men in relation to hundreds of cyber attacks against organizations in the U.S. and multiple other countries in Asia and Europe. Two of the men, who were based in Malaysia, were arrested and their extradition to the U.S. has been requested. The other five are based in China and remain at large.

The attacks were attributed to a China-linked organization dubbed APT41 and involved a combination of intellectual property theft and financially motivated cyber crime. While some of our peers monitor APT41 as a single operation, Symantec regards it as two distinct actors: Grayfly and Blackfly.

Joining us in this week's Research Saturday to discuss the research from Symantec's Threat Hunter Team is Jon DiMaggio.

The research can be found here:

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Malware Mash!

Fri, 30 Oct 2020 05:00:00 -0000

Learn more about your ad choices. Visit megaphone.fm/adchoices

Just saying there are attacks is not enough.

Sat, 24 Oct 2020 05:00:00 -0000

Ben-Gurion University researchers have developed a new artificial intelligence technique that will protect medical devices from malicious operating instructions in a cyberattack as well as other human and system errors. Complex medical devices such as CT (computed tomography), MRI (magnetic resonance imaging) and ultrasound machines are controlled by instructions sent from a host PC. Abnormal or anomalous instructions introduce many potentially harmful threats to patients, such as radiation overexposure, manipulation of device components or functional manipulation of medical images. Threats can occur due to cyberattacks, human errors such as a technician's configuration mistake or host PC software bugs.

As part of his Ph.D. research, Tom Mahler has developed a technique using artificial intelligence that analyzes the instructions sent from the PC to the physical components using a new architecture for the detection of anomalous instructions.

Joining us in this week's Research Saturday to discuss his research is CBG - Cyber@Ben Gurion University's Tom Mahler.

The research can be found here:

A Dual-Layer Architecture for the Protection of Medical Devices from Anomalous Instructions

Learn more about your ad choices. Visit megaphone.fm/adchoices

Intentionally not drawing attention.

Sat, 17 Oct 2020 05:00:00 -0000

Bitdefender researchers recently uncovered a sophisticated APT-style attack targeting an international architectural and video production company. The attack shows signs of industrial espionage, similar to another of Bitdefender’s recent investigations of the StrongPity APT group. The real-estate industry is highly competitive, and information exfiltrated by APT mercenary group can give negotiation advantages to other players in high-profile real-estate contracts.

While APT groups traditionally could only be afforded by governments or were financially motivated purely out of self-interest, they recently appear to have become a commodity.

Joining us in this week's Research Saturday to discuss the research is Global Cybersecurity Researcher Liviu Arsene from Bitdefender.

The research can be found here:

APT Hackers for Hire Used for Industrial Espionage

Learn more about your ad choices. Visit megaphone.fm/adchoices

It's still possible to find ways to break out.

Sat, 10 Oct 2020 05:00:00 -0000

Containers offer speed, performance, and portability, but do they actually contain? While they try their best, the shared kernel is a disturbing attack surface: a mere kernel vulnerability may allow containerized processes to escape and compromise the host. This issue prompted a new wave of sandboxing tools that use either unikernels, lightweight VMs or userspace-kernels to separate the host OS from the container's OS.

One of these solutions is Kata Containers, a container runtime that spawns each container inside a lightweight VM, and can function as the underlying runtime in Docker and Kubernetes. Kata's virtualized containers provide two layers of isolation: even if an attacker breaks out of the container, he is still confined to the microVM.

Joining us in this week's Research Saturday to discuss the research is Yuval Avrahami from Palo Alto Networks Unit 42.

The research presented at Black Hat USA 2020 can be found here:

Escaping Virtualized Containers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Smaug: Ransomware-as-a-service drag(s)on.

Sat, 03 Oct 2020 05:00:00 -0000

Threat actors and cybercriminals that don’t have the ability to develop their own ransomware for malicious campaigns can turn to the Smaug Ransomware as a Service (RaaS) offering, which is available via a Dark Web Onion site. At least two threat actors are operating the site, providing ransomware that can be used to target Windows, macOS, and Linux machines. The site is built with ease of use in mind. To launch an attack, threat actors simply need to sign up, create a campaign, and then start distributing the malware. The site also handles decryption key purchasing and tracking for victims.

Joining us in this week's Research Saturday to discuss the research is Anomali's Joakim Kennedy and Rory Gould.

The research can be found here:

Anomali Threat Research Releases First Public Analysis of Smaug Ransomware as a Service

Learn more about your ad choices. Visit megaphone.fm/adchoices

What came first, the Golden Chickens or more_eggs?

Sat, 26 Sep 2020 05:00:00 -0000

Throughout March and April, QuoIntelligence (QuoINT) observed four attacks (i.e. sightings) utilizing various tools from the Golden Chickens (GC) Malware-as-a-Service (MaaS) portfolio – they recently declassified their findings, after first notifying their clients. Further, during their analysis of the sightings, QuoIntelligence confirmed the GC MaaS Operator, Badbullzvenom, released improved variants with code updates to three tools in the service portfolio.

Joining us in this week's Research Saturday to discuss the research is QuoIntelligence's Vice President of Threat Intelligence, Chaz Hobson.

The research can be found here:

Latest Golden Chickens MaaS Tools Updates and Observed Attacks

Learn more about your ad choices. Visit megaphone.fm/adchoices

Election 2020: What to expect when we are electing.

Sat, 19 Sep 2020 05:00:00 -0000

After the 2016 General Election, the talk was all around foreign meddling. Rumors swirled that some votes may have been changed or influenced by state-sponsored actors. Sanctions and accusations followed. Four years later, is the U.S. any more prepared to protect the results of its largest elections? More than you may realize.

Talos researchers take a deep dive into election security after spending the past four years talking to local, state and national officials, performing their own independent research and even watching one state plan an election in real-time.

Joining us in this week's Research Saturday to discuss the report on this timely topic is Cisco Talos' Matt Olney.

The research can be found here:

What to expect when you’re electing: Talos’ 2020 election security primer.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leveraging legitimate tools.

Sat, 12 Sep 2020 05:00:00 -0000

Researchers at Symantec spotted a Sodinokibi targeted ransomware campaign in which the attackers are also scanning the networks of some victims for credit card or point of sale (PoS) software.

It is not clear if the attackers are targeting this software for encryption or because they want to scrape this information as a way to make even more money from this attack.

Joining us in this week's Research Saturday to discuss the report is Jon DiMaggio of Symantec.

The research can be found here:

Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike

Learn more about your ad choices. Visit megaphone.fm/adchoices

Going after the most valuable data.

Sat, 05 Sep 2020 05:00:00 -0000

A look at the realities of ransomware from Sophos, including an industry-first detailed look at new detection evasion techniques in WastedLocker ransomware attacks that leverage the Windows Cache Manager and memory-mapped I/O to encrypt files. A complementary article examines the evasion-centric arms race of ransomware, providing a months-long review of how cybercriminals have been escalating and markedly changing evasion techniques, tactics and procedures (TTPs) since Snatch ransomware in December 2019.

The research also breaks down the five early warning signs organizations are about to be attacked by ransomware and why ransomware attacks continue to occur.

Joining us on this week's Research Saturday to walk us through the research and share their findings is Sophos' Principal Research Scientist Chet Wisniewski and EVP & Chief Product Officer Dan Schiappa.

The media alert and research articles can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

They fooled a lot of people.

Sat, 29 Aug 2020 05:00:00 -0000

Docker containers have been gaining popularity over the past few years as an effective way of packaging software applications. Docker Hub provides a strong community-based model for users and companies to share their software applications. This is also attracting the attention of malicious actors intending to make money by cryptojacking within Docker containers and using Docker Hub to distribute these images.

Palo Alto Networks' Unit 42 researchers identified a malicious Docker Hub account, azurenql, active since October 2019 that was hosting six malicious images intended to mine the cryptocurrency, Monero. The images hosted on this account have been collectively pulled more than two million times. Additionally, when last checked minexmr.com for this wallet ID, Palo Alto's team saw recent activity indicating that it’s still being used.

Joining us on this week's Research Saturday is Jen Miller-Osborn from Palo Alto Networks' Unit 42 group to share the research and findings.

The research and blog post can be found here:

Attackers Cryptojacking Docker Images to Mine for Monero

Learn more about your ad choices. Visit megaphone.fm/adchoices

Using global events as lures.

Sat, 22 Aug 2020 05:00:00 -0000

Joining us on this week's Research Saturday from Craig Williams from Cisco's Talos Outreach team to walk us through how current events are used as lures.

The research and blog post can be found here:

Adversarial use of current events as lures

The CyberWire's Research Saturday is presented by Juniper Networks.

Thanks to our sponsor Enveil, closing the last gap in data security.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Waiting for their victims.

Sat, 15 Aug 2020 05:00:00 -0000

Bitdefender researchers have recently found the APT group StrongPity has been targeting victims in Turkey and Syria. Using watering hole tactics to selectively infect victims and deploying a three-tier C&C infrastructure to thwart forensic investigations, the APT group leveraged Trojanized popular tools, such as archivers, file recovery applications, remote connections applications, utilities, and even security software, to cover a wide range of options that targeted victims might be seeking.

Joining us on this week's Research Saturday to discuss the research is Bitdefender's Liviu Arsene.

You can find the research here:

StrongPity APT – Revealing Trojanized Tools, Working Hours and Infrastructure

Learn more about your ad choices. Visit megaphone.fm/adchoices

Like anything these days, you have to disinfect it first.

Sat, 08 Aug 2020 05:00:00 -0000

“Cyberbunker” refers to a criminal group that operated a “bulletproof” hosting facility out of an actual military bunker. “Bullet Proof” hosting usually refers to hosting locations in countries with little or corrupt law enforcement, making shutting down criminal activity difficult. Cyberbunker, which is also known as “ZYZtm” and “Calibour”, was a bit different in that it actually operated out of a bulletproof bunker. In September of last year, German police raided this actual Cyberbunker and arrested several suspects.

While most of the group's assets were seized during the initial raid, the IP address space remained and was later sold to Legaco Networks. Before being shut down, Legaco Networks temporarily redirected the traffic to the SANS Internet Storm Center honeypots for examination.

Joining us on this week's Research Saturday from SANS Technology Institute is graduate student Karim Lalji and Dean of Research Johannes Ullrich to discuss their experiences.

The research and blog post can be found here:

Real-Time Honeypot Forensic Investigation on a German Organized Crime Network

Cyberbunker 2.0: Analysis of the Remnants of a Bullet Proof Hosting Provider

Learn more about your ad choices. Visit megaphone.fm/adchoices

Detecting Twitter bots in real time.

Sat, 01 Aug 2020 05:00:00 -0000

NortonLifeLock Research Group (NRG) released a prototype browser extension called BotSight that leverages machine learning to detect Twitter bots in real-time. The tool is intended to help users understand the prevalence of bots and disinformation campaigns within their Twitter feeds, particularly with the increase in disinformation of COVID-19.

Joining us on this week's Research Saturday to discuss this tool is Daniel Kats from NortonLifeLock Research Group.

You can find the research here:

Introducing BotSight

Learn more about your ad choices. Visit megaphone.fm/adchoices

It was only a matter of time.

Sat, 25 Jul 2020 05:00:00 -0000

On April 29, 2020, the Salt management framework, authored by the IT automation company SaltStack, received a patch concerning two CVEs; CVE-2020-11651, an authentication bypass vulnerability, and CVE-2020-11652, a directory-traversal vulnerability.

On April 30, 2020, researchers at F-Secure disclosed their vulnerability findings to the public, with an urgent warning for Salt users - patch now. Before the weekend was out, criminals were deploying malware and targeting vulnerable Salt installations, successfully affecting operations at Ghost, DigiCert, and LineageOS. The malware is a cryptominer, but there is an additional component, a Remote Access Tool written in Go called nspps. Researchers at Akamai have also observed in-the-wild attacks on Salt vulnerabilities.

Joining us on this week's Research Saturday is Larry Cashdollar, Senior Security Response Engineer at Akamai, to discuss this issue.

The research can be found here:

SaltStack Vulnerabilities Actively Exploited in the Wild

Learn more about your ad choices. Visit megaphone.fm/adchoices

Every time we get smarter, the bad guy changes something.

Sat, 18 Jul 2020 05:00:00 -0000

Researchers at Symantec identified and alerted customers to a string of attacks against U.S. companies by attackers attempting to deploy the WastedLocker ransomware (Ransom.WastedLocker) on their networks. The end goal of these attacks is to cripple the victim’s IT infrastructure by encrypting most of their computers and servers in order to demand a multimillion dollar ransom. At least 31 Symantec customer organizations have been attacked, meaning the total number of attacks may be much higher. The attackers had breached the networks of targeted organizations and were in the process of laying the groundwork for staging ransomware attacks.

Joining us in this week's Research Saturday to discuss the report is Jon DiMaggio of Symantec.

The research can be found here:

WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Are you running what you think you're running?

Sat, 11 Jul 2020 05:00:00 -0000

Built into virtually every hardware device, firmware is lower-level software that is programmed to ensure that hardware functions properly.

As software security has been significantly hardened over the past two decades, hackers have responded by moving down the stack to focus on firmware entry points. Firmware offers a target that basic security controls can’t access or scan as easily as software, while allowing them to persist and continue leveraging many of their tried and true attack techniques.

Joining us on this week's Research Saturday is Maggie Jauregui, security researcher at Dell, to discuss this issue.

The research can be found here:

Three firmware blind spots impacting security

Learn more about your ad choices. Visit megaphone.fm/adchoices

Enter the RAT.

Sat, 27 Jun 2020 05:00:00 -0000

A new report examines how five related APT groups operating in the interest of the Chinese government have systematically targeted Linux servers, Windows systems and Android mobile devices while remaining undetected for nearly a decade.

The report comes on the heels of the U.S. Department of Justice announcing several high-profile indictments from over 1,000 open FBI investigations into economic espionage as part of the DOJ’s China Initiative.

Joining us in this week's Research Saturday to discuss the report is Eric Cornelius of Blackberry.

The research can be found here:

Decade of the RATs: Novel APT Attacks Targeting Linux, Windows and Android

Learn more about your ad choices. Visit megaphone.fm/adchoices

Click here to update your webhook.

Sat, 20 Jun 2020 05:00:00 -0000

Slack is a cloud-based messaging platform that is commonly used in workplace communications. Slack Incoming Webhooks allow you to post messages from your applications to Slack. Generally, Slack webhooks are considered a low risk integration. A deeper dive into webhooks shows that this is not entirely accurate.

Joining us in this week's Research Saturday is Ashley Graves from AT&T Cybersecurity's Alien Labs to discuss her research.

The research can be found here:

Slack phishing attacks using webhooks

Learn more about your ad choices. Visit megaphone.fm/adchoices

The value of the why and the who.

Sat, 13 Jun 2020 05:00:00 -0000

Proactive, efficient threat mitigation and risk management require understanding adversaries’ fundamental thought processes, not just their tools and methods. Cyber threat intelligence analysts combed through 15 years (2004 to 2019) of public sources that have documented the activities of one prolific threat actor, Russia’s military intelligence agency, the GRU. Analysis shows that the timing, targets, and impacts of this activity mirrored Russian strategic concerns about specific events and developments.

Joining us in this week's Research Saturday are Brad Stone & Nate Beach-Westmoreland from Booz Allen Hamilton to discuss their report and some of the 33 case studies presented in it.

The research can be found here:

Bearing Witness: Uncovering the Logic Behind Russian Military Cyber Operations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Due diligence cannot be done as a one-off.

Sat, 06 Jun 2020 05:00:00 -0000

Earlier this year, a Virgin Media database containing the personal details of 900,000 people was discovered to be unsecured and accessible online for 10 months. The breach was discovered by researchers at the security firm TurgenSec. This breach had major implications under GDPR.

Joining us in this week's Research Saturday are George Punter and Peter Hansen from TurgenSec to talk about the discovery of the breach.

The research can be found here:

Virgin Media Disclosure Statement & Resources

Learn more about your ad choices. Visit megaphone.fm/adchoices

Twofold snooping venture.

Sat, 30 May 2020 05:00:00 -0000

Working with many different honeypot implementations, a security researcher did an experiment expanding on that setting up a simple docker image with SSH, running a guessable root password. The catch? What happened in the next 24 hours was unexpected.

Joining us in this week's Research Saturday to talk about his experiment is Larry Cashdollar of Akamai.

The research can be found here:

A Brief History of a Rootable Docker Image

Learn more about your ad choices. Visit megaphone.fm/adchoices

Naming and shaming is the worst thing we can do.

Sat, 23 May 2020 05:00:00 -0000

In December 2019, the GOLD VILLAGE threat group that operates the Maze ransomware created a public website to name and shame victims. The threat actors used the website to dump data they exfiltrated from victims' networks before they deployed the ransomware. Secureworks Counter Threat Unit (CTU) researchers have observed several ransomware operators following suit.

Joining us in this week's Research Saturday is Alex Tilley of SecureWorks' Counter Threat Unit.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Gangnam Industrial Style APT campaign targets South Korea.

Sat, 16 May 2020 05:00:00 -0000

Section 52, CyberX’s threat intelligence team, has uncovered an ongoing industrial cyberespionage campaign targeting hundreds of manufacturing and other industrial firms primarily located in South Korea. CyberX has identified more than 200 compromised systems from this campaign, including one belonging to a multi-billion dollar Korean conglomerate that manufactures critical infrastructure equipment such as heavy equipment for power transmission and distribution facilities, renewable energy, chemical plants, welding, and construction.

Joining us in this week's Research Saturday is Phil Neray, one of the authors of this report.

The research can be found here:

Gangnam Industrial Style: APT Campaign Targets Korean Industrial Companies

Learn more about your ad choices. Visit megaphone.fm/adchoices

The U.S. campaign trail is actually quite secure.

Sat, 09 May 2020 05:00:00 -0000

Multiple media reports have indicated that the United States’ (U.S.) 2020 general election could be targeted by foreign and domestic actors after the successful cyber and misinformation attacks during the 2016 general election. The responsibility of secure and ethical online campaigning has become a central issue in the 2020 election. In some cases, it has become part of candidate platforms.

Joining us in this week's Research Saturday is Paul Gagliardi from Security Scorecard, discussing their recent report detailing the cybersecurity of the 2020 Presidential race.

The research can be found here:

2020 Democratic Presidential Candidates Get Smart to Cybersecurity Report

Learn more about your ad choices. Visit megaphone.fm/adchoices

Fingerprint authentication is not completely secure.

Sat, 02 May 2020 05:00:00 -0000

Passwords are the traditional authentication methods for computers and networks. But passwords can be stolen. Biometric authentication seems the perfect solution for that problem.

Our guest today is Craig Williams, director of Talos outreach at Cisco. He'll be discussing and providing insights into their report which shows that fingerprints are good enough to protect the average person's privacy if they lose their phone. However, a person that is likely to be targeted by a well-funded and motivated actor should not use fingerprint authentication.

The research can be found here:

Fingerprint cloning: Myth or reality?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Contact tracing as COVID-19 aid.

Sat, 25 Apr 2020 05:00:00 -0000

Successful containment of the Coronavirus pandemic rests on the ability to quickly and reliably identify those who have been in close proximity to a contagious individual.

Mayank Varia from Boston University describes how his team suggests an approach based on using short-range communication

mechanisms, like Bluetooth, that are available in all modern cell phones.

The research can be found here:

Anonymous Collocation Discovery:

Harnessing Privacy to Tame the Coronavirus

Learn more about your ad choices. Visit megaphone.fm/adchoices

How low can they go? A spike in Coronavirus phishing.

Sat, 18 Apr 2020 05:00:00 -0000

As much of the world grapples with the new coronavirus, COVID-19, and how to handle it, attackers are taking advantage of the widespread discussion of COVID-19 in emails and across the web.

Joining us today is Fleming Shi, CTO of Barracuda discussing their report on these types of attacks, which are up 667-percent since the end of February.

The research can be found here:

Threat Spotlight: Coronavirus-Related Phishing

To learn more about our Academic and Military discounts, visit The CyberWire and click on the Contact Us button in the Academic or Government & Military box.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Profiling an audacious Nigerian cybercriminal.

Sat, 11 Apr 2020 05:00:00 -0000

By day, he is Dton, an upstanding Nigerian citizen. He believes in professionalism, hard work and excellence. He’s a leader, a content creator, an entrepreneur and an innovator; an accomplished business administrator; a renaissance man who is adored by his colleagues. But by night, he is Bill Henry, Cybercriminal Entrepreneur. We sat down with a researcher at CheckPoint for the inside scoop into this fascinating, brazen individual.

The research can be found here:

The Inside Scoop on a Six-Figure Nigerian Fraud Campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

A rough year ahead for ransomware attacks - and how to stop them.

Sat, 04 Apr 2020 05:00:00 -0000

2020 is shaping up to be a rough year. Ransomware attacks will continue to grow as cybercriminals get more sophisticated in their methods and expand their reach. Allan Liska, Senior Analyst at Recorded Future, shares their findings and predictions in a new report.

The research can be found here:

5 Ransomware Trends to Watch in 2020

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hidden dangers inside Windows and LINUX computers.

Sat, 28 Mar 2020 05:00:00 -0000

Eclypsium has issued a study that suggests the prevalence of “unsigned firmware in WiFi adapters, USB hubs, trackpads, and cameras used in computers from Lenovo, Dell, HP and other major manufacturers.” Here to discuss their findings is Rick Altherr, a Principle Engineer at Eclypsium.

The research can be found here:

Perilous Peripherals: The Hidden Dangers Inside Windows and LINUX Computers.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The security implications of cloud infrastructure in IoT.

Sat, 21 Mar 2020 05:00:00 -0000

Cloud computing is now at the center of nearly every business strategy. But, as with the rapid adoption of any new technology, growing pains persist. The key findings in these reports shed light on security missteps that are actually in practice by organizations across the globe.

Joining us in this special Research Saturday are Palo Alto Network's Matthew Chiodi and Ryan Olson. They discuss their findings in two different threat reports.

The research can be found here:

Cloud Threat Report

IoT Threat Report

Learn more about your ad choices. Visit megaphone.fm/adchoices

TLS is here to stay.

Sat, 14 Mar 2020 05:00:00 -0000

As websites and apps more widely adopt TLS (Transport Layer Security) and communicate over HTTPS connections, unencrypted traffic may draw even more attention, since it’s easier for analysts and security tools to identify malicious communication patterns in those plain HTTP sessions. Malware authors know this, and they’ve made it a priority to adopt TLS and thereby obfuscate the contents of malicious communication.

Joining us on this week's Research Saturday is Chester Wisniewski from SophosLabs discussing their research on the subject.

The research can be found here:

Nearly a quarter of malware now communicates using TLS

Learn more about your ad choices. Visit megaphone.fm/adchoices

Overworked developers write vulnerable software.

Sat, 07 Mar 2020 06:00:00 -0000

Why do some developers and development teams write more secure code than others? Software is written by people, either alone or in teams. Ultimately secure code development depends on the actions and decisions taken by the people who develop the code. Understanding the human factors that influence the introduction of software vulnerabilities, and acting on that knowledge, is a definitive way to shift security to the left.

On this Research Saturday, our conversation with Anita D’Amico from CodeDX on which developers and teams are more likely to write vulnerable software.

The research can be found here:

Which Developers and Teams Are More Likely to Write Vulnerable Software?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Application tracking in Wacom tablets.

Sat, 29 Feb 2020 06:00:00 -0000

Today's Research Saturday features our conversation with Robert Heaton, a software engineer with Stripe who penned a blog post about his disappointing discovery involving his Wacom tablet tracking his applications. The post struck a nerve and has since been widely distributed.

The research can be found here:

Wacom drawing tablets track the name of every application that you open

Learn more about your ad choices. Visit megaphone.fm/adchoices

New vulnerabilities in PC sound cards.

Sat, 22 Feb 2020 06:00:00 -0000

SafeBreach Labs discovered a new vulnerability in the Realtek HD Audio Driver Package, which is deployed on PCs containing Realtek sound cards.

On this week's Research Saturday, our conversation with Itzik Kotler, who is Co-Founder and CTO at SafeBreach.

The research can be found here:

Realtek HD Audio Driver Package - DLL Preloading and Potential Abuses

Learn more about your ad choices. Visit megaphone.fm/adchoices

If you can't detect it, you can't steal it.

Sat, 15 Feb 2020 06:00:00 -0000

BGN Technologies, the technology transfer company of Ben-Gurion University (BGU) of the Negev, Israel, is introducing the first all-optical “stealth” encryption technology that will be significantly more secure and private for highly-sensitive cloud computing and data center network transmission. Joining us in this special Research Saturday is BGN's Dan Sadot who helped pioneer this technology.

The Research can be found here:

Ben-Gurion University Researchers Introduce the FirstAll-Optical, Stealth Data Encryption Technology

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Chameleon attacks Online Social Networks.

Sat, 08 Feb 2020 06:00:00 -0000

The Chameleon attack technique is a new type of OSN-based trickery where malicious posts and profiles change the way they are displayed to OSN users to conceal themselves before the attack or avoid detection. Joining us to discuss their findings in a new report entitled "The Chameleon Attack: Manipulating Content Display in Online Social Media" is Ben-Gurion University's Rami Puzis.

The research can be found here:

The Chameleon Attack: Manipulating Content Display in Online Social Media

Demonstration video of a Chameleon Attack

Learn more about your ad choices. Visit megaphone.fm/adchoices

Tracking one of China's hidden hacking groups.

Sat, 01 Feb 2020 06:00:00 -0000

Operation Wocao (我操, “Wǒ cāo”, is a Chinese curse word) is the name that Fox-IT uses to describe the hacking activities of a Chinese based hacking group.

We are joined by Fox-IT's Maarten van Dantzig who shares his insights into their new report entitled "Operation Wocao: Shining a light on one of China’s hidden hacking groups".

The Research can be found here:

Operation Wocao: Shining a light on one of China’s hidden hacking groups

Learn more about your ad choices. Visit megaphone.fm/adchoices

Know Thine Enemy - Identifying North American Cyber Threats.

Sat, 25 Jan 2020 06:00:00 -0000

The electric utility industry is a valuable target for adversaries seeking to exploit industrial control systems (ICS) and operations technology (OT) for a variety of purposes. As adversaries and their sponsors invest more effort and money into obtaining effects-focused capabilities, the risk of a disruptive or destructive attack on the electric sector significantly increases.

Selena Larson from Dragos joins us to discuss their new report North American Electric Cyber Threat Perspective.

The report can be found here:

North American Electric Cyber Threat Perspective

Learn more about your ad choices. Visit megaphone.fm/adchoices

Clever breaches demonstrate IoT security gaps.

Sat, 18 Jan 2020 06:00:00 -0000

Some of our favorite and most trusted IoT devices help make us feel secure in our homes. From garage door openers to the locks on our front doors, we trust these devices to recognize and alert us when people are entering our home. It should come as no surprise that these too are subject to attack.

Steve Povolny is head of advanced research at McAfee; we discuss a pair of research projects they recently published involving popular IoT devices.

The research can be found here:

McAfee Advanced Threat Research demo McLear NFC Ring

McAfee Advanced Threat Research Demo Chamberlain MyQ

Learn more about your ad choices. Visit megaphone.fm/adchoices

Profiling the Linken Sphere anti-detection browser.

Sat, 11 Jan 2020 06:00:00 -0000

Multiple e-commerce and financial organizations around the world are targeted by cybercriminals attempting to bypass or disable their security mechanisms, in some cases by using tools that imitate the activities of legitimate users. Linken Sphere, an anti-detection browser, is one of the most popular tools of this kind at the moment.

Staffan Truvé is the CTO and Co-Founder of Recorded Future, he joins us to discuss their new report on the browser.

The research can be found here:

Profiling the Linken Sphere Anti-Detection Browser

Learn more about your ad choices. Visit megaphone.fm/adchoices

A Jira vulnerability that’s leaking data in the public cloud.

Thu, 02 Jan 2020 23:35:00 -0000

Unit 42 (the Palo Alto Networks threat intelligence team) released new research on a Jira vulnerability that’s leaking data of technology, industrial and media organizations in the public cloud. The vulnerability (a Server Side Request Forgery -- SSRF) is the same type that led to the Capital One data breach in July 2019.

Jen Miller-Osborn is the Deputy Director of Threat Intelligence for Unit 42 at Palo Alto Networks, and she joins us to share their findings.

The research can be found here:

https://unit42.paloaltonetworks.com/server-side-request-forgery-exposes-data-of-technology-industrial-and-media-organizations/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Inside Magecart and Genesis.

Sat, 21 Dec 2019 06:00:00 -0000

Dan Woods is VP of the intelligence center and Shape Security. He shares insights on two noteworthy attacks tools, Genesis and Magecart. Before joining Shape Security Dan served as assistant chief agent of special investigations at the Arizona attorney general's office, where he investigated complex fraud. Prior to that, he spent 20 years with federal law enforcement agencies and intelligence organizations, including the CIA and FBI, where he specialized in information operations and cybercrime.

Learn more about your ad choices. Visit megaphone.fm/adchoices

WAV files carry malicious data payloads.

Sat, 14 Dec 2019 06:00:00 -0000

Researchers at BlackBerry Cylance have been tracking ordinary WAV audio files being used to carry hidden malicious data used by threat actors.

Eric Milam is VP of threat research and intelligence at BlackBerry Cylance, and he joins us to share their findings.

The research can be found here:

https://threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targeting routers to hit gaming servers.

Sat, 07 Dec 2019 06:00:00 -0000

Researchers at Palo Alto Networks' Unit 42 recently published research outlining attacks on home and small-business routers, taking advantage of known vulnerabilities to make the routers parts of botnets, ultimately used to attack gaming servers.

Jen Miller-Osborn is the Deputy Director of Threat Intelligence for Unit 42 at Palo Alto Networks. She joins us to share their findings.

The research can be found here:

https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Mustang Panda leverages Windows shortcut files.

Sat, 23 Nov 2019 06:00:00 -0000

Researchers at Anomali have been tracking China-based threat group, Mustang Panda, believing them to be responsible for attacks making clever use of Windows shortcut files.

Parthiban is a researcher at Anomali, and he joins us to share their findings.

The research is here:

https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sodinokibi aka REvil connections to GandCrab.

Sat, 16 Nov 2019 06:00:00 -0000

Researchers at McAfee's Advanced Threat Research Team have been analyzing Sodinokibi ransomware as a service, also known as REvil. John Fokker is head of cyber investigations for McAfee Advanced Threat Research, and he joins us to share their findings.

The research is here:

https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Monitoring the growing sophistication of PKPLUG.

Sat, 09 Nov 2019 06:00:00 -0000

Researchers from Palo Alto Networks' Unit 42 have been tracking a Chinese cyber espionage group they've named PKPLUG. The group mainly targets victims in the Southeast Asia region. Ryan Olson is VP of threat intelligence at Palo Alto Networks, and he joins us to share their findings.

The original research is here:

https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Usable security is a delicate balance.

Sat, 02 Nov 2019 05:00:00 -0000

Until recently, usability was often an afterthought when developing security tools. These days there's growing realization that usability is a fundamental part of security. Lorrie Cranor is director of the CyLab Usable Privacy and Security lab (CUPS) at Carnegie Mellon University. She shares the work she's been doing with her colleagues and students to improve security through usability.

The research can be found here:

https://www.cylab.cmu.edu/news/2019/07/29-usability-history.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Masad Steals via Social Media.

Sat, 26 Oct 2019 05:00:00 -0000

Researchers at Juniper Networks have been tracking a trojan they call Masad Stealer, which uses the Telegram instant messaging platform for part it its command and control infrastructure. (Telegram wasn't hacked; it's the innocent conduit.) Mounir Hahad is head of Juniper Threat Labs at Juniper Networks and he joins us to share their findings

The original research is here:

https://forums.juniper.net/t5/Threat-Research/Masad-Stealer-Exfiltrating-using-Telegram/ba-p/468559

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hoping for SOHO security.

Sat, 19 Oct 2019 05:00:00 -0000

Researchers at Independent Security Evaluators (ISE) recently published a report titled SOHOpelessly Broken 2.0, Security Vulnerabilities in Network Accessible Services. This publication continues and expands previous work they did examining small office/home office (SOHO) routers, network-attached storage devices (NAS), and IP cameras.

Shaun Mirani is a security analyst at ISE, and he joins us to share their findings.

The original research is here:

https://www.ise.io/whitepaper/sohopelessly-broken-2/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Decrypting ransomware for good.

Sat, 12 Oct 2019 05:00:00 -0000

Michael Gillespie is a programmer at Emsisoft, as well as a host of the popular ID Ransomware web site that helps victims identify what strain of ransomware they may have been infected with, and what decryptors may be available. He's written many decryptors himself, most recently for the Syrk strain of ransomware.

Links to the research and Michael's work:

https://blog.emsisoft.com/en/33885/emsisoft-releases-a-free-decryptor-for-the-syrk-ransomware/

https://id-ransomware.malwarehunterteam.com/

https://www.youtube.com/user/Demonslay335

Learn more about your ad choices. Visit megaphone.fm/adchoices

The fuzzy boundaries of APT41.

Sat, 05 Oct 2019 05:00:00 -0000

Researchers at FireEye recently released a report detailing the activities of APT41, a Chinese cyber threat group notable for the range of tools they use, their origins in the world of video gaming, and their willingness to shift from seemingly state-sponsored activity to hacking for personal gain.

Nalani Fraser and Fred Plan contributed to the report, and they join us to share their findings.

The original research is here:

https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Focusing on Autumn Aperture.

Sat, 28 Sep 2019 05:00:00 -0000

Researchers at Prevalion have been tracking a malware campaign making use of antiquated file formats and social engineering to target specific groups.

Danny Adamitis and Elizabeth Wharton are coauthors of the report, and they join us to share their findings.

The research can be found here:

https://blog.prevailion.com/2019/09/autumn-aperture-report.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leaky guest networks and covert channels.

Sat, 21 Sep 2019 05:00:00 -0000

Many users of inexpensive internet routers use guest network functionality to help secure their home networks. Researchers at Ben Gurion University have discovered methods for defeating these security measures. Dr. Yossi Oren joins us to share their findings.

The original research is here:

https://www.usenix.org/system/files/woot19-paper_ovadia.pdf

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bluetooth blues: KNOB attack explained.

Sat, 14 Sep 2019 05:00:00 -0000

A team of researchers have published a report titled, "KNOB Attack.

Key Negotiation of Bluetooth Attack: Breaking Bluetooth Security." The report outlines vulnerabilities in the Bluetooth standard, along with mitigations to prevent them.

Daniele Antonioli is from Singapore University of Technology and Design, and is one of the researchers studying KNOB. He joins us to share their findings.

The research can be found here:

https://knobattack.com

Learn more about your ad choices. Visit megaphone.fm/adchoices

VOIP phone system harbors decade-old vulnerability.

Sat, 07 Sep 2019 05:00:00 -0000

Researchers at McAfee's Advanced Threat Research Team recently published the results of their investigation into a popular VOIP system, where they discovered a well-know, decade-old vulnerability in open source software used on the platform.

Steve Povolny serves as the Head of Advanced Threat Research at McAfee, and he joins us to share their findings.

The original research can be found here:

https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/avaya-deskphone-decade-old-vulnerability-found-in-phones-firmware/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Emotet's updated business model.

Sat, 31 Aug 2019 05:00:00 -0000

The Emotet malware came on the scene in 2014 as a banking trojan and has since evolved in sophistication and shifted its business model. Researchers at Bromium have taken a detailed look at Emotet, and malware analyst Alex Holland joins us to share their findings.

The research can be found here:

https://www.google.com/url?q=https://www.bromium.com/resource/emotet-a-technical-analysis-of-the-destructive-polymorphic-malware

Learn more about your ad choices. Visit megaphone.fm/adchoices

Gift card bots evolve and adapt.

Sat, 24 Aug 2019 05:00:00 -0000

Researchers at Distil Networks have been tracking online bots targeting ecommerce gift card systems of major online retailers. The threat actors show remarkable resourcefulness and adaptability. Jonathan Butler is technical account team manager at Distil Networks, part of Imperva, and he joins to share their findings.

The research can be found here:

https://resources.distilnetworks.com/all-blog-posts/giftghostbot-attacks-ecommerce-gift-card-systems

Learn more about your ad choices. Visit megaphone.fm/adchoices

Detecting dating profile fraud.

Sat, 17 Aug 2019 05:00:00 -0000

Researchers from King’s College London, University of Bristol, Boston University, and University of Melbourne recently collaborated to publish a report titled, "Automatically Dismantling Online Dating Fraud." The research outlines techniques to analyze and identify fraudulent online dating profiles with a high degree of accuracy.

Professor Awais Rashid is one of the report's authors, and he joins us to share their findings.

The original research can be found here:

https://arxiv.org/pdf/1905.12593.pdf

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unpacking the Malvertising Ecosystem.

Sat, 10 Aug 2019 05:00:00 -0000

The research can be found here:

https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Package manager repository malware detection.

Sat, 03 Aug 2019 05:00:00 -0000

Researchers at Reversing Labs have been tracking malware hidden in software package manager repositories, and it's use as a supply chain attack vector. Robert Perica is a principal engineer at Reversing Labs, and he joins us to share their findings.

The research can be found here:

https://blog.reversinglabs.com/blog/suppy-chain-malware-detecting-malware-in-package-manager-repositories

Learn more about your ad choices. Visit megaphone.fm/adchoices

Day to day app fraud in the Google Play store.

Sat, 27 Jul 2019 05:00:00 -0000

Researchers at bot mitigation firm White Ops have been tracking fraudulent apps in the Google Play store. These apps often imitate legitimate apps, even going so far as to lift code directly from them, but instead of providing true functionality they harvest user data and send it back to command and control servers.

Marcelle Lee is a principal threat intel researcher at White Ops, and she shares their findings.

The original research can be found here —

https://www.whiteops.com/blog/another-day-another-fraudulent-app

Learn more about your ad choices. Visit megaphone.fm/adchoices

Nansh0u not your normal cryptominer.

Sat, 20 Jul 2019 05:00:00 -0000

Researchers at Guardicore Labs have been tracking an unusual cryptominer that seems to be based in China and is targeting Windows MS-SQL and phpMyAdmin servers. Some elements of the exploit make use of sophisticated components previously associated with nation-state actors.

Ophir Harpaz and Daniel Goldberg are members of the Guardicore Labs team, and they join us to explain their findings.

The research can be found here -

https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Opportunistic botnets round up vulnerable routers.

Sat, 13 Jul 2019 05:00:00 -0000

Researchers at Netscout's ASERT Team have been tracking the growth of botnets originating in Egypt and targeting routers in South Africa. The payload is a variant of the Hakai DDoS bot.

Richard Hummel is threat intelligence manager at Netscout, and he joins us to share their findings.

The original research is here:

https://www.netscout.com/blog/asert/realtek-sdk-exploits-rise-egypt

Learn more about your ad choices. Visit megaphone.fm/adchoices

Giving everyone a stake in the success of Open Source implementation.

Sat, 29 Jun 2019 05:00:00 -0000

Synopsys recently published the 2019 edition of their Open Source Security and Risk Analysis (OSSRA) Report, providing an in-depth look at the state of open source security, compliance, and code quality risk in commercial software.

Tim Mackey is principal security strategist within the Synopsys Cyber Research Center, and he joins us to share their findings.

The research can be found here:

https://www.synopsys.com/software-integrity/resources/analyst-reports/2019-open-source-security-risk-analysis.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Middleboxes may be meddling with TLS connections.

Sat, 22 Jun 2019 05:00:00 -0000

Researchers at Cloudflare have been examining HTTPS interception, a technique that weakens security, and have developed tools to help detect it.

Nick Sullivan is head of cryptography at Cloudflare, and he joins to us share their findings.

The research can be found here:

https://blog.cloudflare.com/monsters-in-the-middleboxes/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Apps on third-party Android store carry unwelcome code.

Sat, 15 Jun 2019 05:00:00 -0000

Researchers at Zscaler have been tracking look-alike apps in third-party Android app stores that carry malicious code. Deepen Desai is VP of security research and operations and Zscaler, and he joins us to share their findings.

The original research can be found here:

https://www.zscaler.com/blogs/research/third-party-android-store-sms-trojan

Learn more about your ad choices. Visit megaphone.fm/adchoices

Xwo scans for default credentials and exposed web services.

Sat, 08 Jun 2019 05:00:00 -0000

Researchers at AT&T Alien Labs have been tracking a new malware family they've named "Xwo" that's scanning systems for default credentials and vulnerable web services.

Tom Hegel is security researcher with AT&T Alien Labs, and he share their findings.

The original research is here:

https://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner

Learn more about your ad choices. Visit megaphone.fm/adchoices

Blockchain bandits plunder weak wallets.

Sat, 01 Jun 2019 05:00:00 -0000

Adrian Bednarek is a senior research analyst at Independent Security Evaluators. He and his colleagues looked at weak private cryptocurrency keys on the Ethereum blockchain in an attempt to discover how and why they are being generated as well as how bad actors are taking advantage of them.

The original research is here:

https://www.securityevaluators.com/casestudies/ethercombing/

Learn more about your ad choices. Visit megaphone.fm/adchoices

A fresh look at GOSSIPGIRL and the Supra Threat Actors.

Sat, 25 May 2019 05:00:00 -0000

Chronicle researchers Juan Andres Guerrero Saade and Silas Cutler recently published research tracking the development of the Stuxnet family of malware, which ultimately led them to the GOSSIPGIRL Supra Group of threat actors.

Juan Andres Guerrero Saade joins us to share their findings.

The research can be found here:

https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0

Learn more about your ad choices. Visit megaphone.fm/adchoices

Elfin APT group targets Middle East energy sector.

Sat, 18 May 2019 05:00:00 -0000

Researchers at Symantec have been tracking an espionage group known as Elfin (aka APT 33) that has targeted dozens of organizations over the past three years, primarily focusing on Saudi Arabia and the United States.

Alan Neville is a principal threat intelligence analyst at Symantec, and he joins us to share their findings.

The research can be found here:

https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage

Learn more about your ad choices. Visit megaphone.fm/adchoices

Steganography enables sophisticated OceanLotus payloads.

Sat, 11 May 2019 05:00:00 -0000

Researchers at Blackberry Cylance have been tracking payload obfuscation techniques employed by OceanLotus (APT32), specifically steganography used to hide code within seemingly benign image files.

Tom Bonner is director of threat research at Blackberry Cylance, and he joins us to share their findings.

The original research can be found here:

https://www.cylance.com/en-us/lp/threat-research-and-intelligence/oceanlotus-steganography-malware-analysis-white-paper-2019.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sea Turtle state-sponsored DNS hijacking.

Sat, 04 May 2019 05:00:00 -0000

Researchers at Cisco Talos have been tracking what they believe is a state-sponsored attack on DNS systems, targeting the Middle East and North Africa. This attack has the potential to erode trust and stability of the DNS system, so critical to the global economy.

Craig Williams is director of Talos Outreach at Cisco, and he joins us to share their findings.

The original research can be found here:

https://blog.talosintelligence.com/2019/04/seaturtle.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Deep Learning threatens 3D medical imaging integrity.

Sat, 27 Apr 2019 05:00:00 -0000

Researchers at Ben Gurion University in Israel have developed techniques to infiltrate medical imaging system networks and alter 3D medical scans within, fooling both human and automated examiners with a high rate of success.

Yisroel Mirsky is a cybersecurity researcher and project manager at Ben Gurion University, and he joins us to share what his team discovered.

The original research can be found here:

https://arxiv.org/pdf/1901.03597.pdf

A video demonstrating the exploit is here:

https://youtu.be/_mkRAArj-x0

Learn more about your ad choices. Visit megaphone.fm/adchoices

Undetectable vote manipulation in SwissPost e-voting system.

Sat, 20 Apr 2019 05:00:00 -0000

Researchers have discovered a number of vulnerabilities in the SwissPost e-vote system which could allow undetectable manipulation of votes.

Dr Vanessa Teague is Associate Professor and Chair, Cybersecurity and Democracy Network at the Melbourne School of Engineering, University of Melbourne, Australia. She joins us to explain her team's findings.

The original research is here:

https://people.eng.unimelb.edu.au/vjteague/SwissVote

Learn more about your ad choices. Visit megaphone.fm/adchoices

Establishing software root of trust unconditionally.

Sat, 13 Apr 2019 05:00:00 -0000

Researchers at Carnegie Mellon University's CyLab Security and Privacy Institute claim to have made an important breakthrough in establishing root of trust (RoT) to detect malware in computing devices. Virgil Gligor is one of the authors of the research, and he joins us to share their findings.

Link to original research -

https://www.ndss-symposium.org/ndss-paper/establishing-software-root-of-trust-unconditionally/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lessons learned from Ukraine elections.

Sat, 06 Apr 2019 05:00:00 -0000

Joep Gommers from EclecticIQ joins us to share their research tracking the information operations and and security methods they've been tracking that Russians have been using in advance of the recently held elections in Ukraine.

The research can be found here:

https://www.eclecticiq.com/resources/fusion-center-report-situational-awareness-ukraine-elections

Learn more about your ad choices. Visit megaphone.fm/adchoices

Alarming vulnerabilities in automotive security systems.

Sat, 30 Mar 2019 05:00:00 -0000

Researchers at Pen Test Partners recently examined a variety of third-party automotive security systems and found serious security issues, potentially giving bad actors the ability to locate, disable or meddle with multiple vehicle systems.

Ken Munro is a security researcher with Pen Test Partners, and he joins us to share their findings.

The original research can be found here:

https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ryuk ransomware relationship revelations.

Sat, 23 Mar 2019 05:00:00 -0000

Investigators from McAfee's advanced threat research unit, working with partners at Coveware, have reevaluated hasty attributions of Ryuk ransomware to North Korea and have explored the inner workings of the threat.

John Fokker is head of cyber investigations in McAfee's Advanced Threat research unit. He join us to share their findings.

The original research can be found here:

https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ryuk-exploring-the-human-connection/

Learn more about your ad choices. Visit megaphone.fm/adchoices

ThinkPHP exploit from Asia-Pacific region goes global.

Sat, 16 Mar 2019 05:00:00 -0000

Akamai's Larry Cashdollar joins us to describe an exploit he recently came across while researching MageCart incidents. It's a remote command execution vulnerability affecting ThinkPHP, a popular web framework.

The original research can be found here:

https://blogs.akamai.com/sitr/2019/01/thinkphp-exploit-actively-exploited-in-the-wild.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Job-seeker exposes banking network to Lazurus Group.

Sat, 09 Mar 2019 06:00:00 -0000

Vitali Kremez is a Director of Research at Flashpoint. His team discovered that the recently disclosed intrusion suffered in December 2018 by Chilean interbank network Redbanc involved PowerRatankba, a malware toolkit with ties to North Korea-linked group Lazarus. The intrusion represents the latest known example of Lazarus-affiliated tools being deployed within financially motivated activity targeted toward financial institutions in Latin America.

The original research can be found here:

https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Fake Fortnite app scams infect gamers.

Sat, 02 Mar 2019 06:00:00 -0000

Researchers at Zscaler have been tracking a variety fake versions of the popular Fortnite game on the Google Play store, along with associated scams. Deepen Desai is head of security research at Zscaler, and he joins us to share their findings.

The original research can be found here:

https://www.zscaler.com/blogs/research/fake-fortnite-apps-scamming-and-spying-android-gamers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rosneft suspicions shift from espionage to business email compromise.

Sat, 23 Feb 2019 06:00:00 -0000

Researchers at security firm Cylance have been tracking a threat group targeting the Rosneft Russian oil company. As Cylance uncovered details, suspicions shifted from state-sponsored espionage to business email compromise.

Kevin Livelli is director of threat intelligence at Cylance, and he joins us to share what they found.

The original research can be found here:

https://threatvector.cylance.com/en_us/home/poking-the-bear-three-year-campaign-targets-russian-critical-infrastructure.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

Seedworm digs Middle East intelligence.

Sat, 16 Feb 2019 06:00:00 -0000

Al Cooley is director of product management at Symantec, and he joins us to share their findings.

The original research can be found here:

https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

Learn more about your ad choices. Visit megaphone.fm/adchoices

Trends and tips for cloud security.

Sat, 09 Feb 2019 06:00:00 -0000

The team at Palo Alto Networks' Unit 42 recently published research tracking trends in how organizations are addressing cloud security, along with tips for improvement.

Ryan Olson is VP of threat intelligence at Palo Alto Networks, and he joins us to share their findings.

The original research can be found here:

https://unit42.paloaltonetworks.com/unit-42-cloud-security-trends-tips/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Online underground markets in the Middle East.

Sat, 02 Feb 2019 06:00:00 -0000

Researchers at Trend Micro recently published their look inside online underground marketplaces in the Middle East and North Africa, where criminals are buying and selling malware, laundering money and event booking their next discount vacation.

Jon Clay is director of global threat communications at Trend Micro, and he joins us with their findings.

The original research can be found here:

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cash-and-communication-new-trends-in-the-middle-east-and-north-africa-underground

Learn more about your ad choices. Visit megaphone.fm/adchoices

Amplification bots and how to detect them.

Sat, 26 Jan 2019 06:00:00 -0000

Researchers from Duo Security have been analyzing the behavior of Twitter bots in a series of posts on their web site. Their most recent dive into the subject explores amplification bots, which boost the impact of tweets through likes and retweets.

Jordan Wright is a principal R&D engineer at Duo Security, and he joins us to share their findings.

Link to the original research -

https://duo.com/labs/research/anatomy-of-twitter-bots-amplification-bots

Learn more about your ad choices. Visit megaphone.fm/adchoices

Luring IoT botnets to the honeypot.

Sat, 19 Jan 2019 06:00:00 -0000

Researchers from Netscout's ASERT team have been making use of honeypots to gather information on rapidly evolving IoT botnets that take advantage of default usernames and passwords to gain access and take control of unprotected devices.

Matt Bing is a security research analyst with Netscout, and he guides us through their findings.

The original research can be found here:

https://asert.arbornetworks.com/dipping-into-the-honeypot/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Magecart payment card theft analysis.

Sat, 12 Jan 2019 06:00:00 -0000

Researchers at RiskIQ have been tracking a series of web-based credit card skimmers known as Magecart. We take a closer look at attacks on Ticketmaster, British Airways, NewEgg and Shopper Approved payment card pages.

Yonathan Klijnsma is lead of threat research at RiskIQ, and he guides us through what they've learned.

Links to RiskIQ research:

https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/

https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

https://www.riskiq.com/blog/labs/magecart-newegg/

https://www.riskiq.com/blog/labs/magecart-shopper-approved/

Learn more about your ad choices. Visit megaphone.fm/adchoices

NOKKI, Reaper and DOGCALL target Russians and Cambodians.

Sat, 05 Jan 2019 06:00:00 -0000

Researchers from Unit 42 at Palo Alto Networks have discovered an interesting relationship between the NOKKI and DOGCALL malware families, as well as a new RAT being used to deploy the malware.

Jen Miller-Osborn is Deputy Director of Threat Intelligence with Unit 42, and she joins us to share their findings.

The original research can be found here:

https://unit42.paloaltonetworks.com/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Apple Device Enrollment Program vulnerabilities explored.

Sat, 22 Dec 2018 06:00:00 -0000

Researchers at Duo Security have been looking into Apple's Device Enrollment Program (DEM) and have discovered vulnerabilities that could expose users of the service to potential issues from social engineering and rogue devices.

James Barclay is Senior R&D Engineer at Duo Security, and he joins us to share what they've found.

The original research can be found here:

https://duo.com/blog/weak-apple-dep-authentication-leaves-enterprises-vulnerable-to-social-engineering-attacks-and-rogue-devices

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Sony hack and the perils of attribution.

Sat, 15 Dec 2018 06:00:00 -0000

Researchers at Risk Based Security took a detailed look back at the 2014 Sony hack, comparing analysis that occurred while the facts were still unfolding with what we know, today. There are interesting lessons to be learned, especially when it comes to attribution.

Brian Martin is V.P. of vulnerability intelligence at Risk Based Security, and he shares their findings.

The research can be found here:

https://www.riskbasedsecurity.com/2018/09/you-didnt-think-the-sony-saga-was-over-did-you/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Operation Red Signature targets South Korean supply chain.

Sat, 08 Dec 2018 06:00:00 -0000

Researchers at Trend Micro uncovered a supply chain attack targeting organizations in South Korea. With the goal of information theft, attackers compromised the update server of a third party support provider, resulting in the installation of a RAT, or remote access trojan.

Rik Ferguson is Vice President of Security Research at Trend Micro, and he guides us through their discoveries.

The research can be found here:

https://blog.trendmicro.com/trendlabs-security-intelligence/supply-chain-attack-operation-red-signature-targets-south-korean-organizations/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Getting an education on Cobalt Dickens.

Sat, 01 Dec 2018 06:00:00 -0000

Researchers from Secureworks' Counter Threat Unit have been tracking a threat group spoofing login pages for universities. Evidence suggests the Iranian group Cobalt Dickens is likely responsible.

Allison Wikoff is a senior researcher at Secureworks, and she joins us to share what they've found.

The original research is here:

https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities

Learn more about your ad choices. Visit megaphone.fm/adchoices

Doubling down on Cobalt Group activity.

Sat, 17 Nov 2018 06:00:00 -0000

The NETSCOUT Arbor ASERT team has been tracking Cobalt Group campaigns targeting financial institutions. Richard Hummel is manager of threat intelligence with ASERT, and he joins us to share his team's findings.

The research can be found here:

https://asert.arbornetworks.com/double-the-infection-double-the-fun/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Establishing international norms in cyberspace.

Sat, 10 Nov 2018 06:00:00 -0000

Joseph Nye is former dean of the Harvard Kennedy School of Government. He served as Chair of the National Intelligence Council, and as Assistant Secretary of Defense for International Security Affairs under President Clinton. He serves as a Commissioner for the Global Commission on Internet Governance, and is the author of over a dozen books, including, “Soft Power: The means to success in work politics,” and “The future of power.”

Learn more about your ad choices. Visit megaphone.fm/adchoices

Election protection.

Sat, 03 Nov 2018 05:00:00 -0000

Symantec technical director Vikram Thakur returns to share his team's look at threat groups APT 28 and APT 29, the influence they had on the 2016 election, and how the cyber security industry has responded in preparation for the 2018 midterms.

The original research can be found here:

https://www.symantec.com/blogs/election-security/election-hacking-faq

Learn more about your ad choices. Visit megaphone.fm/adchoices

Faxploitation.

Sat, 27 Oct 2018 05:00:00 -0000

Researchers at security firm Check Point Software Technologies explored the possibility of exploiting old, complex fax protocols to gain access to modern multifunction office printers, and then pivot to connected networks.

Yaniv Balmas is head of security research at Check Point, and he joins us to share what he and his colleague Eyal Itkin discovered.

The research can be found here:

https://research.checkpoint.com/sending-fax-back-to-the-dark-ages/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stormy weather in the Office 365 cloud.

Sat, 20 Oct 2018 05:00:00 -0000

Security firm Lastline recently took a close look at threats to the Office 365 cloud environment, taking advantage of the insights they gain protecting their clients.

Andy Norton is director of threat intelligence at Lastline, and he joins us to describe their findings.

The research can be found here:

https://www.lastline.com/blog/malspam-malscape-snapshot-malicious-activity-in-the-office-365-cloud/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Driving GPS manipulation.

Sat, 13 Oct 2018 05:00:00 -0000

Researchers at Virginia Tech investigate possible ways to manipulate GPS signals and send drivers to specific locations without their knowledge.

Gang Wang is Assistant Professor of Computer Science at Virginia Tech, and he joins us to share his team's findings.

The original research can be found here:

https://people.cs.vt.edu/gangwang/sec18-gps.pdf

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cryptojacking criminal capers continue.

Sat, 06 Oct 2018 05:00:00 -0000

Researchers at Palo Alto Networks' Unit 42 have been tracking the rise of cryptocurrency mining operations run by criminal groups around the world. Ryan Olson is V.P. of threat intelligence at Palo Alto Networks, and he joins us to share what they've learned.

The original research can be found here:

https://researchcenter.paloaltonetworks.com/2018/06/unit42-rise-cryptocurrency-miners/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sophisticated FIN7 criminal group hits payment card data.

Sat, 29 Sep 2018 05:00:00 -0000

Researchers at security firm FireEye have been tracking malicious actors they call FIN7, a group which targets payment card data in the hospitality industry and elsewhere. They make use of targeted phishing campaigns, telephone vishing and even a convincing front company to do their deeds.

Nick Carr and Barry Vengerick are coauthors of the research, along with their colleagues Kimberly Goody and Steve Miller.

The research is titled On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. It can be found here:

https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

ICS honeypots attract sophisticated snoops.

Sat, 22 Sep 2018 05:00:00 -0000

Researchers at security firm Cybereason recently set up online honeypots to attract adversaries interested in industrial control system environments. It didn't take long for sophisticated attackers to sniff out the virtual honey and start snuffling around.

Ross Rustici is senior director of intelligence services at Cybereason, and he joins us to share what they learned.

The research is titled ICS Threat Broadens: Nation-state Hackers are no Longer the Only Game in Town. It can be found here:

https://www.cybereason.com/blog/industrial-control-system-specialized-hackers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Android device eavesdropping investigation.

Sat, 15 Sep 2018 10:00:00 -0000

A team of researchers from Northeastern University and UC Santa Barbara examined over 17,000 Android apps, and revealed a number of alarming privacy risks.

Elleen Pan and Christo Wilson were members of the research team, and they join us to share what they found.

The research is titled Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications. It can be found here:

https://recon.meddle.mobi/papers/panoptispy18pets.pdf

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leafminer espionage digs the Middle East.

Sat, 08 Sep 2018 10:00:00 -0000

Researchers at Symantec recently published their findings on an active attack group named Leafminer that's targeting government organizations and businesses in the Middle East region.

Vikram Thakur is a technical director at Symantec, and he joins us to share what they've found.

The research can be found here:

https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east

Learn more about your ad choices. Visit megaphone.fm/adchoices

ATM hacks on the rise.

Sat, 01 Sep 2018 10:00:00 -0000

Threat researcher Marcelle Lee from LookingGlass Cyber Solutions joins us to share her research on the growing threat of ATM hacks in the U.S.

The research can be found here:

https://www.lookingglasscyber.com/blog/atm-hacking-you-dont-have-to-pay-to-play/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber espionage coming from Chinese University.

Sat, 25 Aug 2018 10:00:00 -0000

Threat intelligence firm Recorded Future recently published research describing espionage activities originating from servers at a major Chinese university, coinciding with international economic development efforts.

Winnona DeSombre and Sanil Chohan are authors of the report, Chinese Cyberespionage Originating from Tsinghua University Infrastructure, along with their colleague Justin Grosfelt.

The research can be found here:

https://www.recordedfuture.com/chinese-cyberespionage-operations/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stealthy ad fraud campaign evades detection.

Sat, 18 Aug 2018 10:00:00 -0000

Researchers at Bitdefender have been tracking a bit of complex rootkit malware called Zacinlo that they suspect has been operating virtually undetected for over six years. Bogdan Botezatu is a senior cyber security analyst with Bitdefender, and he describes what they've found.

Research link:

https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the-complex-zacinlo-ad-fraud-operation/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Thrip espionage group lives off the land.

Sat, 11 Aug 2018 10:00:00 -0000

Researchers at Symantec have been tracking a wide-ranging espionage operation that's targeting satellite, telecom and defense companies.

Jon DiMaggio is a senior cyber intelligence analyst at Symantec, and he takes us through what they've discovered.

The research can be found here:

https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cortana voice assistant lets you in.

Sat, 04 Aug 2018 11:00:00 -0000

Researchers at McAfee recently discovered code execution vulnerabilities in the default settings of the Cortana voice-activated digital assistant in Windows 10 systems.

Steve Povolny is head of advanced threat research at McAfee and he shares their findings.

The research can be found here:

https://securingtomorrow.mcafee.com/mcafee-labs/want-to-break-into-a-locked-windows-10-device-ask-cortana-cve-2018-8140

Learn more about your ad choices. Visit megaphone.fm/adchoices

BabaYaga strangely symbiotic Wordpress malware.

Sat, 28 Jul 2018 11:00:00 -0000

Researchers at Defiant recently analyzed a malware family they named "BabaYaga," which has the curious behavior of clearing out other malware and keeping infected sites up to date.

Brad Hass is a senior security analyst at Defiant, and he guides us through their findings.

The research can be found here:

https://www.wordfence.com/blog/2018/06/babayaga-wordpress-malware/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Measuring the spearphishing threat.

Sat, 21 Jul 2018 11:00:00 -0000

Researchers Gang Wang and Hang Hu from Virginia Tech recently conducted an end-to-end measurement on 35 popular email providers and examining user reactions to spoofing through a real-world spoofing/phishing test. Gang Wang joins us to share the sobering results.

End-to-End Measurements of Email Spoofing Attacks

https://people.cs.vt.edu/gangwang/usenix-draft.pdf

Learn more about your ad choices. Visit megaphone.fm/adchoices

A new approach to mission critical systems.

Sat, 14 Jul 2018 11:00:00 -0000

Andy Bochman is senior grid strategist for Idaho National Lab’s National and Homeland Security directorate. Today we’re discussing the research the INL has been doing, developing new approaches to protecting mission critical systems.

Learn more about your ad choices. Visit megaphone.fm/adchoices

No Distribute Scanners help sell malware.

Sat, 07 Jul 2018 11:00:00 -0000

Sellers of malware on Dark Web forums often use No Distribute malware scanning tools to help verify the effectiveness of their wares, while preventing legitimate virus scanning tools from adding the malware to their database.

Daniel Hatheway is a Senior Security Analyst at Recorded Future, and he takes us through their recently published research, Uncover Unseen Malware Samples with No Distribute Scanners.

Learn more about your ad choices. Visit megaphone.fm/adchoices

VPNFilter malware could brick devices worldwide.

Sat, 30 Jun 2018 11:00:00 -0000

Researchers from Cisco Talos continue to track malware they've named VPNFilter, a multi-stage infection with multiple capabilities, targeting consumer-grade routers. Craig Williams is head of Cisco Talos Outreach, and he joins us with the details.

Learn more about your ad choices. Visit megaphone.fm/adchoices

LG smartphone keyboard vulnerabilities.

Sat, 23 Jun 2018 11:00:00 -0000

Researchers at Check Point Research recently discovered vulnerabilities in some LG smartphone keyboards, vulnerabilities that could have been used to remotely execute code with elevated privileges, act as a keylogger and thereby compromise the users’ privacy and authentication details.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber bank heists.

Sat, 16 Jun 2018 11:00:00 -0000

Carbon Black's Chief Cybersecurity Officer Tom Kellerman shares the results of their recent report, Modern Bank Heists: Cyberattacks & Lateral Movement in the Financial Sector.

For the report, they interviewed CISOs at 40 major financial institutions, revealing attack and mitigation trends.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Winnti Umbrella Chinese threat group.

Sat, 09 Jun 2018 11:00:00 -0000

Researchers from ProtectWise's 401TRG team recently published research linking a variety of new and previously reported Chinese cyber threat groups.

Tom Hegel is a Senior Threat Researcher with the 401TRG, and he joins us to share their findings.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Islamic State propaganda persistence.

Sat, 02 Jun 2018 11:00:00 -0000

Researchers from Flashpoint recently explored ISIS' ability to distribute propaganda across the internet, and their use of major internet service providers to help them achieve persistence.

Ken Wolf is a Senior Analyst at Flashpoint, and he describes what they learned.

Learn more about your ad choices. Visit megaphone.fm/adchoices

UPnProxy infiltrates home routers.

Sat, 26 May 2018 11:00:00 -0000

Researchers at Akamai recently published a white paper titled UPnProxy: Blackhat proxies via NAT Injections.

In it, they describe vulnerabilities with Universal Plug and Play capabilities in home routers, and how malicious actors could take advantage of them.

Chad Seaman is a senior CERT engineer at Akamai, and he's our guide.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Threat actors hijack Lojack.

Sat, 19 May 2018 11:00:00 -0000

Researchers from Arbor Networks' ASERT Threat Intelligence Team recently published a report titled, "Lojack Becomes a Double Agent." It outlines how threat actors are altering legitimate recovery utility software and simulating its command and control servers to gain access to target machines.

Richard Hummel is manager of the ASERT Threat Research Team, and he joins us to describe their work.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Three pillars of Artificial Intelligence.

Sat, 12 May 2018 11:00:00 -0000

Bobby Filar is a Principal Data Scientist at Endgame, and coauthor of the research paper, The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation. The report surveys the landscape of potential security threats from malicious uses of AI, and proposes ways to better forecast, prevent, and mitigate these threats. Bobby Filar joins us to discuss the paper, and his views on the evolving role of AI in cybersecurity.

The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

Learn more about your ad choices. Visit megaphone.fm/adchoices

BlackTDS and ThreadKit offered in criminal markets.

Sat, 05 May 2018 11:00:00 -0000

Kevin Epstein is Vice President of Proofpoint's Threat Operations Center. We’re discussing two bits of research with him today. The first is about BlackTDS, a traffic distribution tool for sale in dark web markets. A little later in the show, he’ll tell us about ThreadKit, a document exploit builder.

Learn more about your ad choices. Visit megaphone.fm/adchoices

New MacOS backdoor linked to OceanLotus.

Sat, 28 Apr 2018 11:00:00 -0000

Researchers at Trend Micro recently discovered a backdoor targeting MacOS users that they believe is the work of the OceanLotus threat group, an organization previously thought to have launched targeted attacks against human rights organizations, media organizations, research institutes, and maritime construction firms.

Mark Nunnikhoven is VP of Cloud Research at Trend Micro, and he explains what they've learned.

https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/

Learn more about your ad choices. Visit megaphone.fm/adchoices

InnaputRAT exfiltrates victim data.

Sat, 21 Apr 2018 11:00:00 -0000

Researchers with Arbor Networks ASERT team have been tracking a malware campaign targeting commercial manufacturing, and have uncovered various samples dating back to at least 2016.

Richard Hummel is Threat Intelligence Manager for Arbor Networks' ASERT Team, and he takes us through what they've discovered.

https://www.arbornetworks.com/blog/asert/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Energetic Dragonfly and DYMALLOY Bear 2.0.

Sat, 14 Apr 2018 11:00:00 -0000

Researchers at Cylance recently uncovered the malicious use of a core router in a campaign aimed at critical infrastructure around the world.

Kevin Levelli is Director of Threat Intelligence at Cylance, and he takes us through what they've discovered.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Crypto crumple zones.

Sat, 07 Apr 2018 11:00:00 -0000

In their recently published paper, "Crypto Crumple Zones: Enabling Limited Access Without Mass Surveillance," coauthors Charles Wright and Mayank Varia make their case for an alternative approach to the encryption debate, one based on economics as a limiting factor on government overreach and surveillance.

Crypto Crumple Zones: Enabling Limited Access Without Mass Surveillance

Learn more about your ad choices. Visit megaphone.fm/adchoices

Chasing FlawedAMMYY.

Sat, 31 Mar 2018 11:00:00 -0000

FlawedAMMYY is a newly discovered remote access trojan (RAT) that’s been used in malicious email campaigns, as far back as 2016.

Ryan Kalember is Senior Vice President of Cyber Security Strategy at Proofpoint, and he takes us through their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Code comments cause SAML conundrum.

Sat, 24 Mar 2018 11:00:00 -0000

Researchers at Duo Security recently unearthed a new vulnerability class that affects SAML-based single sign-on (SSO) systems. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim user’s password.

Kelby Ludwig is a Senior Application Security Engineer at Duo security, and he takes us through his discoveries.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cryptojacking injections heat up.

Sat, 17 Mar 2018 11:00:00 -0000

There's been an epidemic of cryptojacking code injections recently, as bad actors attempt to cash in on the cryptocurrency craze through unauthorized cryptomining operations on unsuspecting users.

Marcelle Lee is a threat researcher at LookingGlass, and she takes us through her recently published research, Cryptojacking — Coming to a Server Near You.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dark Caracal APT steals out of Lebanon.

Sat, 10 Mar 2018 12:00:00 -0000

Researcher from Lookout and the EFF have discovered an APT group operating out of Lebanon they've named Dark Caracal. The group is running a global espionage campaign, targeting journalists, military personnel, activists, lawyers, medical professionals and educational institutions.

Mike Murray is VP of Security Intelligence at Lookout, and he's our guide through their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lebal malware phishes for victims.

Sat, 03 Mar 2018 12:00:00 -0000

Researchers at Comodo Security Solutions have been tracking a recently discovered strain of malware named Lebal. The malware uses several clever techniques to attempt to hide itself, and once installed targets credentials and cryptocurrency wallets.

Fatih Orhan is VP of Threat Labs at Comodo, and he takes us through their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing for holiday winnings.

Sat, 24 Feb 2018 12:00:00 -0000

Or Katz is principal lead security researcher for Akamai's Enterprise Security Business Unit, and the research he’s sharing today is a widespread phishing campaign targeting users using an advertising tactic. The research is titled, “Gone Phishing for the Holidays."

Learn more about your ad choices. Visit megaphone.fm/adchoices

The uncanny HEX men.

Sat, 17 Feb 2018 12:00:00 -0000

The research we’re discussing today is called, “Beware the Hex Men”, and it tracks multiple attack campaigns conducted by a Chinese threat actor. The GuardiCore Labs team identified three attack variants that they named Hex, Hanako and Taylor, targeting SQL servers.

Learn more about your ad choices. Visit megaphone.fm/adchoices

IcedID banking trojan.

Sat, 10 Feb 2018 12:00:00 -0000

IcedID is a banking trojan recently discovered and tracked by IBM's X-Force research team, targeting banks, payment card providers, mobile services providers, payroll, webmail and e-commerce sites in the U.S.

Limor Kessem is an executive security advisor with IBM Security. She returns to Research Saturday to describe what she and her team found.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Advanced adware with nation-state tactics.

Sat, 03 Feb 2018 12:00:00 -0000

Adware is generally considered unsophisticated, and because of its low perceived threat level it's often ignored. Researchers at the Booz Allen Dark Labs' Advanced Threat Hunt Team have recently published research describing a more advanced type of adware, using infection techniques usually attributed to nation-state actors.

Jay Novak is a threat hunter and tech lead at Booz Allen, and he takes us through their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targeting Olympic organizations.

Sat, 27 Jan 2018 12:00:00 -0000

This week we’re discussing the a campaign the McAfee Advanced Threat Research team recently discovered, one that’s targeting organizations involved with the upcoming Pyeongchang Winter Olympics.

Raj Samani is chief scientist at McAfee, and he shares the campaign's clever details.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Fancy Bear Duping Doping Domains.

Sat, 20 Jan 2018 12:00:00 -0000

Researchers at ThreatConnect have discovered evidence that Fancy Bear, a cyber espionage group generally associated with Russia's military agency GRU, may be spoofing domains belonging to the World Anti-Doping Agency (WADA), the US Anti-Doping Agency (USADA), and the Olympic Council of Asia.

Kyle Ehmke is a threat intelligence researcher with ThreatConnect, and he takes us through their work.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shake Your MoneyTaker.

Sat, 13 Jan 2018 12:00:00 -0000

A group of Russian-speaking hackers have stolen nearly $10 million from banks around the world. Group-IB, a company with expertise in computer forensics, information security and, specifically, Russian‑speaking criminal groups, have named these thieves MoneyTaker. Nicholas Palmer is the director of international business development at Group-IB, and he's joined by their head of threat intelligence, Dmitry Volkob to explain the MoneyTaker group's schemes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

TRISIS Malware: Fail-safe fail.

Sat, 06 Jan 2018 12:00:00 -0000

Robert M. Lee. is CEO of Dragos Security, a company that specializes in the protection of industrial control systems. He’s describing his team's research on TRISIS, tailored ICS malware infecting safety instrumented systems (SIS), so far found only in the middle east. It's only the fifth known incident of malware targeting ICS systems.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hunting the Sowbug.

Sat, 30 Dec 2017 12:00:00 -0000

Alan Neville is a senior threat intelligence analyst at Symantec located in Dublin. He is responsible for leading and documenting investigations into high priority attacks.

He recently published research on the Sowbug cyber espionage group targeting South American and Southeast Asian governments.

https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments

Learn more about your ad choices. Visit megaphone.fm/adchoices

Keyboys back in town.

Sat, 23 Dec 2017 12:00:00 -0000

In this edition of the CyberWire Research Saturday, we'll take a look at a more recent intrusion PwC has uncovered, named KeyBoy and highly likely a China-based threat actor. It uses compromised Word documents to gain access.

Bart Parys is a lead researcher in PwC's cyber threat intelligence team, responsible for tracking cyber threat actors, their latest toolsets and methodologies.

https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html

Learn more about your ad choices. Visit megaphone.fm/adchoices

The unique culture of the Middle Eastern and North African underground.

Sat, 16 Dec 2017 12:00:00 -0000

Online underground markets thrive across the globe, with the Middle East and North Africa being no exception. Researchers at Trend Micro recently too a look inside these digital souks, and while much of what they discovered matches similar online marketplaces, there are unique cultural elements that set these regional trading posts apart.

Jon Clay is a cyber security expert from Trend Micro, and he takes us through their research paper, "Digital Souks: A Glimpse into the Middle East and North African Underground."

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stealthy Zberp Banking Trojan.

Sat, 09 Dec 2017 12:00:00 -0000

Zberp is a stealthy banking trojan with an unconventional process injection technique. A hybrid of the ZeusVM and Carberp malware, Zberp uses a variety of techniques to prevent detection while it gathers information from infected systems.

Limor Kessem is an executive security advisor for IBM, and she's our guide.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Staying ahead of Fast Flux Networks.

Sat, 02 Dec 2017 12:00:00 -0000

Bad actors are using Fast Flux Networks with quickly-changing IP addresses and domain names to help hide their activities.

Or Katz, Principal Lead Security Researcher at Akamai, takes us through their recently-published white paper, "Digging Deeper — An In-Depth Analysis of a Fast Flux Network."

Learn more about your ad choices. Visit megaphone.fm/adchoices

Waiting for Terdot, a sneaky banking Trojan.

Sat, 25 Nov 2017 12:00:00 -0000

The Terdot Banker Trojan is a descendant of the Zeus family of malware, and has evolved to feature serious espionage capabilities. It can compromise transactions, steal accounts and credit card information, and can eavesdrop on and modify traffic on social media and email platforms. While not yet widely spread, it's a threat to consumers and businesses alike.

Bogdan Botezatu is a senior e-threat analyst at Bitdefender, and he takes us through their recently published whitepaper.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dark Net Pricing with Flashpoint's Liv Rowley.

Sat, 18 Nov 2017 12:00:00 -0000

Cybercriminals offer all sorts of illicit goods for sale on Deep and Dark Web markets. In this episode, Liv Rowley, cybercrime intelligence analyst at Flashpoint, takes us through her team's research into the pricing of certain illegal goods online, including "Fullz", exploit kits, DDoS for hire, RDP servers, card data, bank logs and passports. Supply meets demand in this shady underground ecosystem.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taiwan Bank Heist and Lazurus Group with BAE's Adrian Nish.

Sat, 11 Nov 2017 12:00:00 -0000

Dr. Adrian Nish is head of cyber threat intelligence at BAE Systems. His team has been tracking a new cyber-enabled bank heist in Asia. Some of the tools used are reminiscent of the Bangladesh Bank attack from February 2016.

The full report can be found here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Exploring Phishing Kits with Duo Security's Jordan Wright.

Sat, 04 Nov 2017 11:00:00 -0000

In this episode of the CyberWire’s Research Saturday we are joined by Jordan Wright, Senior Research and Development Engineer at Duo Security. He’s the author of the research report, “Phish in a Barrel,” which describes his work gathering and examining thousands of phishing kits from around the web.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Tracking a Trojan: KHRAT.

Sat, 28 Oct 2017 15:06:00 -0000

The moniker KHRAT came about because of the identification of a Remote Access Trojan (RAT) with command and control infrastructure found in Cambodia (KH). In the most recent episode of the CyberWire's Research Saturday, Ryan Olson, Director of Threat Intelligence at Palo Alto Networks, talks with us about the capabilities of KHRAT and shares details the feature set it provides to threat actors that use it.

https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Learn more about your ad choices. Visit megaphone.fm/adchoices

WireX BotNet with Justin Paine from Cloudflare.

Sat, 21 Oct 2017 11:00:00 -0000

In August 2017, multiple Content Delivery Networks (CDNs) and content providers were subject to significant attacks from a botnet dubbed WireX. (The botnet is named for an anagram for one of the delimiter strings in its command and control protocol.) The WireX botnet is primarily made up of Android devices running malicious applications and is designed to create DDoS traffic. The botnet is sometimes associated with ransom notes to targets.

Justin Paine is Head of Trust and Safety at Cloudflare, and he joins us to share the WireX story.

https://blog.cloudflare.com/the-wirex-botnet/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Synthesized DNA Malware with Peter Ney.

Sat, 14 Oct 2017 11:00:00 -0000

Peter Ney is a PhD candidate in the Allen School of Computer Science and Engineering at the University of Washington where he is advised by Professor Tadayoshi Kohno. His current research is focused on understanding computer security risks in emerging technologies like DNA synthesis and sequencing and the new threats posed by maliciously crafted, synthetic DNA. He and his team found that security of DNA processing programs is poor and show with a proof-of-concept that it is possible to attack computer systems with adversarial synthetic DNA.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Android Toast Overlay: Ryan Olson from Palo Alto Networks.

Sat, 07 Oct 2017 11:00:00 -0000

Android Toast Overlay enables attackers to trick Android users into enabling permissions on infected devices by making them think they are clicking on benign buttons superimposed over the user interface.

Ryan Olson is Director of Threat Intelligence at Palo Alto Networks' Unity 42, and he joins us to share their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

APT 33: FireEye's John Hultquist on an Iranian Cyber Espionage Group.

Sat, 30 Sep 2017 11:00:00 -0000

APT 33 is an Iranian cyber espionage group that targets aerospace and energy sectors and has ties to destructive malware. John Hultquist is Director of Intelligence Analysis at FireEye, and he takes us through their research.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pacifier APT : Bitdefender's Liviu Arsene describes a sophisticated, multifaceted malware campaign.

Sat, 23 Sep 2017 11:00:00 -0000

In 2016 Bitdefender uncovered a new advanced persistent threat dubbed Pacifier, targeting government institutions starting in 2014. Using malicious .doc documents and .zip files distributed via spear phishing e-mails, attackers would lure victims with invitations to social functions or conferences into executing the attachments. It’s capable of dropping multi-stage backdoors.

Liviu Arsene is a senior e-threat analyst at BitDefender, and he's our guide to the complex components of Pacifier APT.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cobian RAT: Zscaler’s Deepen Desai describes some clever malware.

Sat, 16 Sep 2017 11:00:00 -0000

Deepen Desai, senior director of security research and operations at Zscaler, describes research he and his team have been doing since discovered a clever bit of malware they’ve named Cobian RAT. (RAT stands for Remote Access Trojan.) It’s available for free, but contains a back door that allows the original author to access and control the RAT remotely.

Learn more about your ad choices. Visit megaphone.fm/adchoices