Adversary Universe Podcast

A Deep Dive into DeepSeek and the Risks of Foreign LLMs Feb 20, 2025

DeepSeek took the internet by storm earlier this year, making headlines and sparking conversations about its development, use, and associated risks. Today, Adam and Cristian take a deep dive into the new AI model.

At a time when new AI models are constantly emerging, the launch of DeepSeek has led to questions and concerns around AI model security, data security, and national security. What is DeepSeek, and how was it trained? What are the risk implications of using it? Are there safe ways to explore new AI models, or should they be avoided entirely? And how worried do we need to be about data poisoning?

Tune in for the answers to these questions and more in this episode of the Adversary Universe podcast.

Putting a Spotlight on Energy Sector Threats with Corelight's Greg Bell Feb 06, 2025

Cyberattacks targeting critical infrastructure have made more headlines in recent years, sparking concern about how these systems are protected. Adversaries are taking aim at older technologies that are both essential to everyday life and difficult to secure.

Our guest for this episode is Greg Bell, chief strategy officer at Corelight. Before he co-founded the network security firm, Greg spent most of his career working in the National Laboratory system, part of the U.S. Department of Energy. He brings his perspective and expertise to this conversation about energy sector threats, the adversaries behind them, and the unique challenges that utility organizations face in detecting and defending against cyberattacks.

There is a scary side to energy sector threats — but there is also an optimistic side. Adam, Cristian, and Greg discuss everything from the history of critical infrastructure threats to the attacks they’re seeing today, the complications of securing energy systems, and collaborative efforts to improve defense. Key to these efforts are partnerships like the one between CrowdStrike and Corelight, which work together to improve network threat detection and response.

Come for the comprehensive look at energy sector threats and stay for Cristian’s energy sector puns in this episode of the Adversary Universe podcast.

See You I-Soon: A Peek at China’s Offensive Cyber Operations Jan 16, 2025

“It would not be an understatement to say that China is the number one national security concern that I think we have here in the West.”

China’s offensive cyber activity has undergone a massive shift: What used to be simple smash-and-grab operations in the mid-2000s have evolved into sophisticated business models. We got a lens into this environment through a leak stemming from Chinese company I-Soon, whose data provided a narrow but revealing glimpse into the Chinese cyber contractor marketplace.

I-Soon is a mid-sized contractor that has been operating since 2010. It provides state-sponsored advanced persistent threat (APT) cyber operations and tools, surveillance products and training for public security agencies, intelligence services and the military. The leak, which came from an anonymous GitHub user, included its internal documents and employee chat logs. These shed light on its products, services and customers as well as how some China-nexus adversaries are connected and sharing tools and capabilities.

Adam and Cristian take a deep dive into these findings and how Chinese offensive cyber operations reached this point. They also dig into which PANDA adversaries are connected to I-Soon, how the cyber contractor recruits talent and what we learned about its disgruntled staff. The key takeaway? Leaks like this won’t stop adversaries — and China’s cyber operations aren’t slowing down.

The Most Prolific Adversaries and Threats of 2024 Dec 19, 2024

It has been another busy year for defenders and adversaries alike. As we wrap up 2024, Adam and Cristian reflect on the nation-state and eCrime threat activity that defined this year and what they expect as we head into 2025.
Tune in to hear their observations on changing eCrime activity in Latin America, Chinese adversaries evolving their tactics and targeting telecommunications entities, the disruption of eCrime operations in the United States and more. And of course, you’ll hear the stories and context behind how these events unfolded and how we got to where we are today.
Thank you to our listeners for all your support this year. We appreciate you sharing feedback and topics you’d like to hear on the show. As we plan for 2025, we anticipate another year of in-depth conversations, adversary insight and guest perspectives on the Adversary Universe podcast. Happy holidays!

Cross-Domain Attacks: Know Them, Find Them, Stop Them Dec 12, 2024

Adversaries have realized their time-honored attack methods involving clunky malware and malicious attachments are no longer working, largely due to endpoint detection and response tools alerting security teams to their activity. To improve their success rate, many are turning to cross-domain attacks.

Cross-domain attacks span multiple domains within an organization’s environment; namely, identity, endpoint and cloud. An adversary most often starts with a set of stolen credentials, which allows them to log in and operate under the guise of a legitimate employee. From there, they might target the cloud control plane to access more accounts or pivot to unmanaged devices. All the while, they move silently, achieving their goals without triggering alarms.

“The adversaries have really figured out how to operate from the shadows more effectively,” Adam says.

In this episode, he and Cristian discuss how cross-domain attacks unfold in a target environment; which adversaries are adopting this tradecraft; and how organizations can better detect, identify and mitigate these threats before it’s too late.

Watch our Cyber Threat Summit (focused on the rise of cross-domain attacks) on-demand: https://www.crowdstrike.com/resources/crowdcasts/cyber-threat-summit/

LIMINAL PANDA and the Implications of Global Telco Targeting Nov 27, 2024

On Nov. 19, 2024, Adam testified in front of the U.S. Senate Judiciary Subcommittee on Privacy, Technology, and the Law on Chinese cyber threats to critical infrastructure. This was the first time he publicly spoke about LIMINAL PANDA, a China-nexus state-sponsored threat actor that has been targeting telecommunications organizations since at least 2020.

LIMINAL PANDA is a newly named adversary, but CrowdStrike has been tracking its activity for over three years. It uses custom tools and demonstrates extensive knowledge of telco networks, including the connections between providers. And it's not alone: There are multiple adversaries targeting telcos, with good reason — the access they grant, and the data they possess, is a gold mine for threat actors.

But LIMINAL PANDA’s activity does more than showcase why critical infrastructure is a valuable target. It also represents how Chinese cyber activity has evolved since the mid-2000s, when it mostly involved “smash and grab” operations. Now, China has refined its espionage operations to conduct subtle and advanced attacks targeting critical infrastructure entities around the world.

In this episode, Adam and Cristian dig deep into the discovery of LIMINAL PANDA, the maturation of Chinese cyber operations and the scary consequences of telco-focused cyberattacks. Adam shares more about his congressional testimony and the value of keeping government officials informed on adversary activity. Come for Adam and Cristian’s Thanksgiving recipes, and stay for a deep-dive on this evolving nation-state threat, in this episode of the Adversary Universe podcast.

Read Adam's testimony here: https://www.judiciary.senate.gov/committee-activity/hearings/big-hacks-and-big-tech-chinas-cybersecurity-threat

Exploring Offensive Security with CrowdStrike Red Teamers Nov 07, 2024

If a business wants to know what an adversary might be capable of, they can seek the help of a red team. These cybersecurity professionals are tasked with emulating adversary activity to achieve specific objectives in their clients’ environments. Their goal is to find an organization’s weaknesses — before a real adversary does — so it can strengthen its security posture. But what does a red team actually do, and who are the people on these teams?

In this episode, Cristian is joined by CrowdStrike Director of Professional Services Vincent Uguccioni and Professional Services Principal Consultant Brent Harrell to dive into all things red teaming. Both seasoned experts with fascinating backgrounds, Vincent and Brent define what red teaming is (and what it isn’t), explain how it has evolved, debunk common misconceptions about what red teamers do and explain the value of the many different skills the members of a red team have.

The goal of the red team is to help, not hurt. Red teamers may need to think like an adversary when they’re navigating a client environment, but their broader strategy involves collaborating with the client and blue team to guide remediation and improve the client's security. Vincent and Brent also walk us through the process of a red team engagement, from initial client discussions to final reporting, and share how they adjust their approaches as adversary techniques evolve. And if you’re interested in becoming a red teamer, they share some guidance for that as well.

On a related note, we recently introduced CrowdStrike AI Red Team Services. Read our blog for more details: https://www.crowdstrike.com/en-us/blog/crowdstrike-launches-ai-red-team-services/

The Latest in China-Taiwan Cyber Tensions Oct 24, 2024

China and Taiwan have a long history of geopolitical tension that has evolved from land and sea to cyberspace. Relations between the two recently took an interesting turn when the Chinese Ministry of State Security (MSS) claimed hacktivist entity Anonymous 64 targeted China and its territories with attempted disinformation and public communication disruption. The Chinese government further alleged the activity was directed by the Taiwanese government, whose officials are investigating the activity and expressed the claims are false.

These allegations mark an interesting shift in the relations between China and Taiwan. In this episode, Adam and Cristian start with a 50,000-foot view of their nuanced, tense history. They define and discuss the organizations involved in these events and the details of their claims, and they share what we know about Anonymous 64. Why is this news significant? What are the geopolitical implications? And where have we seen similar activity in other regions?

It is important to note that CrowdStrike has not independently verified the Chinese government’s accusations. Tune in to hear more about a story that blends politics, military strategy and digital warfare.

How CrowdStrike Tracked INDRIK SPIDER from Origin to Takedown Oct 10, 2024

On Oct. 1, 2024, an international law enforcement coalition announced the disruption of a senior member of INDRIK SPIDER, who was also an affiliate of the BITWISE SPIDER ransomware as a service operation. CrowdStrike often works with law enforcement to identify, track and stop cyber threats, and we played a key role in this operation.

In this episode, Adam and Cristian are joined by a member of CrowdStrike’s intelligence collection team to dive into the takedown, the years of cybercrime evolution that led to it and how CrowdStrike collects the intel that informs organizations and aids law enforcement activity. Their conversation takes us back to the early days of INDRIK SPIDER and traces the emergence and transformation of enterprise malware as it relates to this prolific threat actor. The story underscores how adversaries operate like businesses — and why they’re so hard to bring down.

Tune in to learn the background and significance of INDRIK SPIDER and its takedown, its connections to Russian intelligence, the techniques used to investigate and attribute adversaries, what this means for the future of law enforcement against cybercrime and where cheese-covered sushi fits into the picture.

Small But Mighty: The Kernel’s Essential Role in Cybersecurity Defense Oct 01, 2024

The kernel is the brain of the operating system. It controls everything that happens on a computer and has full access to the hardware and all system resources. Though it has a small code base, the kernel plays a critical role in how systems and applications operate, interact and stay secure.

Due to the current architecture and design of Windows systems, cybersecurity products running in the platform — particularly those involved in endpoint protection — require kernel access to provide the highest levels of visibility, enforcement and tamper-resistance while meeting the strict performance requirements that large enterprise clients demand. Kernel access translates to stronger protection, better performance and adaptability to emerging threats.

In this episode, Adam and Cristian are joined by cybersecurity expert Alex Ionescu to unpack what the kernel is and its critical role in cybersecurity defense. They explain threats to kernel security, why kernel access is critical for cybersecurity products and the testing that security products must undergo to gain kernel access. Looking ahead, they also discuss what we can expect for the future of collaboration among Microsoft, security researchers and larger security organizations.

Coming Soon to Las Vegas: Adversary Universe Previews #FalCon2024 Sep 12, 2024

Next week marks the start of Fal.Con 2024. CrowdStrike’s annual conference brings together cybersecurity leaders and practitioners, as well as our customers and partners, in Las Vegas for four days of keynotes, breakout sessions, workshops and demos.

Adam and Cristian will both be speaking at this year’s show. In this episode, they share the talks they’re most excited about and how they tie into the broader threat landscape. Some sessions will dive into insights from the CrowdStrike Counter Adversary Operations team; some will explore how adversaries are using large language models (LLMs) and how to defend against adversarial use of AI technology. One will discuss generative AI and data security, in particular how genAI raises concerns around privacy, data fencing, and IP, as well as how data can be misused when training new AI models.

A key highlight of Fal.Con is the Adversary Underground, during which Adam and Cristian will bring guests onstage to showcase a machine learning-based research project they’ve been working on.

Register for the Fal.Con Digital Experience to stream the keynotes live during the show and view select sessions on-demand after the event.

Intern Spotlight: Starting A Cyber Career with CrowdStrike Aug 29, 2024

For students aspiring to work in cybersecurity, sitting in a classroom isn’t enough to gain the skills and experience they need to succeed. Industry internships are invaluable opportunities to learn how security pros operate in the real world and understand the responsibilities each role requires.

CrowdStrike’s University Program welcomes interns across virtually every field to gain this real-world experience. This summer, David Feldman and Chandler McClellan interned for the CrowdStrike threat intelligence and Falcon Adversary OverWatch teams, respectively. Like many cybersecurity pros, both David and Chandler found their way into the industry after first exploring different fields. In this episode, they join Adam to share the details of how they got into cybersecurity, how they discovered CrowdStrike’s internship program and the projects they’ve been tackling as part of the CrowdStrike team.

“You just get to dive in,” says Chandler in this episode. “You feel like you’re doing meaningful work, and you are ... What we’re doing here matters.”

Tune in to learn how CrowdStrike’s interns are aiding in the fight against adversaries, what they consider the coolest parts of their summer roles and more in this episode of the Adversary Universe podcast.

Hunting the Rogue Insiders Operating for FAMOUS CHOLLIMA Aug 20, 2024

FAMOUS CHOLLIMA, a new adversary CrowdStrike is tracking, has recently made headlines for its insider threat activity. In April 2024, CrowdStrike Services responded to the first of several incidents in which FAMOUS CHOLLIMA threat actors targeted 30+ US-based companies. The insiders claimed to be US residents and were hired for remote IT positions, which granted them access they exploited to attempt data exfiltration, install malware and conduct other malicious activity. CrowdStrike has now informed more than 100 companies they have hired these threat actors as employees.

In this episode, Adam and Cristian dig into the details of who FAMOUS CHOLLIMA is, how this attack was uncovered and why malicious insider threats are on the rise. They also examine the key findings of the CrowdStrike 2024 Threat Hunting Report, including the growth of cross-domain activity, adversary adoption of remote monitoring and management tools, and the concerning pattern of identity-focused attacks.

Download the CrowdStrike 2024 Threat Hunting Report today: https://www.crowdstrike.com/resources/reports/threat-hunting-report/

Talking OT Security with Fernando Madureira, Global CISO of Cosan Jul 11, 2024

Where in the world are Adam and Cristian? In this episode, they’re coming to you live from São Paulo, Brazil, where they sat down with a special guest: Fernando Madureira. Fernando is the Global CISO of Cosan, a Brazilian conglomerate of several businesses spanning energy, transportation and logistics, and other sectors that operates around the world.

Given Cosan’s size and the nature of its business, Fernando has a broad range of threats at top of mind. Operational technology (OT) security is a key concern because adversaries seek access to OT devices and traffic, and it requires a different mindset and technology than a modern IT environment. Social engineering is another, as adversaries attempt to disguise themselves as employees to manipulate customers and partners.

Tune in to hear a conversation that explores OT security, modern phishing scams and how the Global CISO of a major company is taking steps to protect it.

How Adversaries Respond to Law Enforcement Takedowns Jun 27, 2024

What happens when there is a takedown of a major cybercriminal group or law enforcement activity has a major impact on its leadership?

In this episode, Adam and Cristian unpack what happens in the aftermath of a takedown, including how some groups splinter, reemerge and even rebrand.

When the Adversary Knows They’re Caught Jun 13, 2024

How do adversaries react when they know they’re being tracked? How do they respond to organizations that are on to them — and how do they know what the defenders know?

In this episode, Adam and Cristian explore how adversary behavior shifts as their activity is discovered and tracked. Today’s adversaries carefully research their victims. They read corporate blog posts and craft their techniques based on the information defenders share. As this intelligence becomes more detailed, organizations like CrowdStrike are forced to consider an important question: How much information can they share when they know adversaries are looking for it? Helping potential victims often comes at the cost of adversaries knowing we can see them and shifting their behavior accordingly.

How does their behavior change? As always, it depends on the group. Tune in for this fascinating conversation and real-world examples of adversaries responding to defenders’ actions.

Unpacking China-India Cyber Tensions May 30, 2024

What happens when two cyber superpowers — and the most populous countries in the world — target one another? Tensions between China and India have been rising in recent years, and it’s time we take a deep dive into the many factors at play.

In this episode, Adam and Cristian examine the dynamics between the two nations, the drivers of their evolving cyber activity and the key adversaries involved in this growing conflict. “The key thing to understand here is adversaries are not only focused on us … in the U.S. or in Europe … and they’re not only focused on a particular business vertical,” says Adam. “They target each other all the time.”

When did we start to see this adversary-vs.-adversary conflict? What do the attacks between China and India look like? And how have we seen other nations target one another around the world? Tune in for these answers and to learn what organizations operating in these countries need to know to stay secure.

Understanding Social Engineering with Shelly Giesbrecht, Director, Professional Services May 23, 2024

Social engineering is not a new threat — adversaries have long used psychological manipulation to gain access, money, information and more. But as we learn in this episode from Shelly Giesbrecht, Director of Professional Services at CrowdStrike, it remains a top cybersecurity challenge for all organizations.

Today’s social engineers are more convincing than ever. Gone are the days of clunky phishing emails rife with spelling errors. Modern social engineering attacks arrive as convincing and well-crafted text messages, emails and voice calls. They prey on human emotion and instinct, creating situations where technology can’t always help.

“It really comes down to that human factor,” says Shelly. “We talk a lot about technology, and obviously CrowdStrike is a technology company, but we are fallible still at the human level — and that’s where social engineering is targeted.”

In a conversation that starts with impostor syndrome and quickly pivots to the impostors who are emailing employees and calling help desks, Adam, Cristian and Shelly explore the modern social engineering landscape. Shelly describes what her team is seeing on the front lines of incident response, how social engineering campaigns are evolving with the rise of AI, and guidance for organizations worried about this prolific technique.

Hacktivism and the JACKALs Behind It May 09, 2024

The rise of hacktivism — the use of hacking techniques to make a statement supporting a political or social cause — is often associated with the Occupy Wall Street movement and the Anonymous hacktivist collective. But the practice of hacking as a form of civil disobedience goes back to the 1990s. It has taken many forms in the years since, driven by a wide range of hacktivists around the world.

In this episode, Adam and Cristian trace the history of hacktivism to its early days, dive into high-profile examples and explain the practice of “faketivism” often used among nation-states. They share why hacktivism is top of mind during a year in which 55 countries have held, or will hold, elections. And they disclose the meaning behind JACKAL, the name CrowdStrike broadly uses to track activists who operate online. Tune in for an engaging explanation of a complex and oft overlooked topic.

Building a Strong Threat Hunting Program with Andrew Munchbach Apr 25, 2024

Organizations fear adversaries will attack. Threat hunters assume adversaries are already in the system — and their investigations seek unusual behavior that may indicate malicious activity is afoot.

Andrew Munchbach, CrowdStrike’s Global VP, Field Engineering, joins Adam and Cristian in this week’s episode to explore what threat hunting is, how it works, and what makes a good threat hunting program.

As CrowdStrike’s “Chief Reddit Officer”, Andrew also shares how he came to run CrowdStrike’s Reddit account and discusses the platform’s evolving role in communicating with the security community. Now with nearly 20,000 followers, CrowdStrike’s Reddit account is used to share information — from key data on active attacks to weekly threat hunting exercises — with CrowdStrike customers and the general public.

Adversary Attribution: What It Means and How It Works Apr 11, 2024

Today’s conversation explores a common question around adversary activity: Why does attribution matter? When a cyberattack hits, why go to the trouble of learning who is behind it? Each attempt at an intrusion can reveal a lot about an adversary — who they are, what they’re doing and what their motivations may be.

This information can not only inform your response to an attack but how you strengthen your security architecture against future attacks. In this episode, Adam and Cristian discuss the importance of knowing who the adversary is and what they’re after.

They go back to the early days of adversary attribution, explain how adversaries are tracked as their activity changes over time and examine the value of this intelligence in helping organizations succeed in the face of evolving cyber threats.

The tool Adam mentions at the end of this episode can be found at https://adversary.crowdstrike.com/

LIVE from Gov Threat Summit: A Chat with Morgan Adamski, Chief of the NSA’s Cybersecurity Collaboration Center Mar 28, 2024

The National Security Agency’s Cybersecurity Collaboration Center (CCC) was created based on a growing need for the public and private sectors to work together and share insights to understand adversaries’ intentions, as well as the scope and scale of their activity. In this special episode of the Adversary Universe podcast, Adam and Cristian are joined by Morgan Adamski, Chief of the CCC and government security expert, onstage at CrowdStrike’s Gov Threat Summit in Washington, D.C.

“We both had different pieces of the puzzle,” said Adamski of the NSA and private sector organizations, which collect different types of data on adversaries and how they operate. In this conversation, she, Adam and Cristian discuss the CCC’s mission and its evolution, explain how it works with private sector partners, and go “around the world” to discuss their observations of modern nation-state adversary activity.

CrowdStrike CSO Shawn Henry on Election Security, Nation-State Threats and His FBI Career Mar 14, 2024

CrowdStrike Chief Security Officer Shawn Henry joined CrowdStrike as employee number 19 after a 24-year career at the FBI, where he retired as the Bureau’s Executive Assistant Director.

Today, he joins Adam and Cristian for a wide-ranging conversation exploring his early days at CrowdStrike and transition to the private sector, his perspective on the 2016 DNC breach and the risks modern elections face. Adversaries have numerous opportunities to sway voters’ opinions — and now they have the technology to wield greater influence through misinformation and disinformation campaigns.
“I think we've just scratched the surface with AI from a deepfake perspective,” Shawn says of how artificial intelligence may play a role in this activity. Tune in to hear his perspective, stories and guidance as we navigate this election year.

A Human at the Keyboard: CrowdStrike Reports 60% Jump in Interactive Intrusions Feb 22, 2024

The days of automated cyberattacks are dwindling: last year CrowdStrike saw a 60% jump in interactive intrusions, a type of attack in which a human is on the other side, working to break in and navigating their target environment as soon as they gain access. Most (75% of) attacks in 2023 didn’t involve malware at all — in nearly all cases, the adversary relied on identity-related techniques or exploited an unmanaged device. The threat landscape is constantly evolving as adversaries explore new tactics. And as the CrowdStrike 2024 Global Threat Report shows, a lot can change in a year. We’re seeing more adversaries, operating at greater speed and conducting more attacks than ever. In this episode, Adam and Cristian reflect on the early days of the Global Threat Report and examine the key findings of this year’s report. Highlights include:

62 minutes: The average time an adversary needs to move from an initial access point to another host in the target environment
232: The number of adversaries CrowdStrike tracks
75%: The year-over-year increase in attacks targeting cloud environments
76% increase in postings on data leak sites

Download your copy of the CrowdStrike 2024 Global Threat Report today at crowdstrike.com/global-threat-report

The Dark Personality Traits Fueling Cybercrime Feb 15, 2024

CrowdStrike has long said, “You don’t have a malware problem — you have an adversary problem.” Much like we analyze the malware and tools used in cyberattacks, we must also learn about the people who orchestrate them.
Adam and Cristian are joined by Cameron Malin, a behavioral profiler who specializes in understanding adversaries and the “why” behind their activity. Cameron built the FBI’s Cyber Behavioral Analysis Unit, which works to understand the motivations for cybercrime across different types of offenses and has focused for years on exploring why adversaries do what they do. In this episode, he discusses how the discipline of cyber behavioral profiling emerged, how experts approach interviewing and analyzing adversaries, and the “dark triad” and “dark tetrad” of personality traits commonly observed in cyberattacks.

Demystifying North Korea: Why the "Hermit Kingdom" Is a Cyber Threat to Watch Feb 01, 2024

Though the inner workings of North Korea remain a mystery to much of the world, its global cyber activity has been tracked and analyzed for years. CrowdStrike’s Counter Adversary Operations team, which tracks five North Korean threat actors, has a unique perspective on the country’s evolution as a global cybersecurity threat and the many ways it has used cyber capabilities to achieve its goals.

In this episode, Adam and Cristian trace the history of North Korean cyber operations from its early days of destructive attacks to its focus on financial gain and espionage. Tune in for the answers to questions such as: How does North Korea discover its cyber talent? When did it pivot to cryptocurrency theft? And why does CrowdStrike track North Korean adversaries under the name CHOLLIMA? Come for the history, stay for Cristian’s singing skills in this conversation about the complex and changing world of North Korean cyber activity.

Check out some the CHOLLIMAs we track here:

AI Through the Defender’s Lens: A Chat with CrowdStrike’s Global CTO Jan 18, 2024

Cristian is joined by CrowdStrike Global CTO Elia Zaitsev to revisit the world of AI and large language models (LLMs), this time from the perspective of modern defenders.

While this space has seen explosive growth in the past year, most organizations are still working to determine how LLM technology fits into their cybersecurity strategies. In this episode, Cristian and Elia unpack the rapid evolution of AI models — a trend the two consider both exciting and frightening — and examine how LLMs are empowering defenders, their effect on automation in the enterprise and why humans will continue to be part of the picture even as AI-powered tools evolve.

Additional Resources:

Inside Russia’s Laboratory of Cyber Operations — and Beyond Jan 11, 2024

In mid-December 2023, an adversary CrowdStrike tracks as VOODOO BEAR targeted Ukrainian telecom provider Kyivstar, wreaking havoc and disrupting thousands of systems and assets.

The Russia-linked adversary has for years treated Ukraine as its “lab of offensive cyber operations”, testing attack techniques and demonstrating the destructive behavior it has become known for since it emerged in late 2010.

In this episode, Adam and Cristian dive into the details of the recent Kyivstar attack and how it aligns with VOODOO BEAR’s history of disruptive cyberattacks, both in Ukraine and around the world. They also pull back the curtain on the broad, complex history of Russian intrusion operations, shedding light on adversaries operating within the country and what has motivated them over the years.

Adversary Universe: 2023 Highlights Dec 28, 2023

It has been a whirlwind year for the cybersecurity industry.

In this episode of the Adversary Universe podcast, we revisit clips from standout episodes of 2023. Tune in to catch pieces of our conversations on the evolution of cloud-focused cyberattacks, the rise of cyber activity from Iran and China, the process of discovering and mitigating vulnerabilities, the role of AI in the cyber threat landscape and more. For those who want to listen to the full episodes related to each of these clips, the episodes highlighted here are in the following order:

Adversaries and AI: Today’s Reality and Tomorrow’s Potential Data
Extortion Dethrones Ransomware as the Threat to Watch
Cloud Is the New Battleground
Invisible Threats: Discovering, Tracking and Mitigating Vulnerabilities
Have You Been Breached?
Urgent Care Required: The State of Healthcare Cybersecurity
Iran’s Rise from Nascent Threat Actor to Global Adversary
Inside China’s Evolution as a Global Security Threat

Inside the ”Alphabet Soup” of Incident Reporting Regulations Dec 14, 2023

Organizations around the world must navigate a growing number of cyber incident reporting regulations mandated by government bodies.

In the U.S., these regulations come from agencies including the Securities and Exchange Commission (SEC), Federal Trade Commission (FTC), Cybersecurity and Infrastructure Security Agency (CISA) and others. This “alphabet soup” of regulations, as Cristian puts it, can be tough for businesses to understand and follow — especially as the threat landscape evolves and compliance requirements change.
In this episode, Cristian is joined by Drew Bagley, VP and Counsel for Privacy and Policy at CrowdStrike, to dig into the details of why these myriad regulations have emerged and shed some light on common questions: When does a breach need to be reported, and why is the timeline a hot debate topic? What is a “material breach”? How are adversaries using these regulations to their advantage? And most importantly, how should businesses respond to all of this? Tune in for these answers — and more.

Data Extortion Dethrones Ransomware as the Threat to Watch Nov 30, 2023

Today’s adversaries are working smarter, not harder — and it’s clear in the way their tactics are evolving.

In this episode, Adam and Cristian explore the way adversaries are shifting their focus to data extortion. Instead of deploying noisy ransomware, more threat actors are quietly stealing data and threatening to publicly leak it if they’re not paid. Tune in to learn what’s driving this change, why data extortion is successful and what it means for organizations of all sizes and industries.

Get your copy of the CrowdStrike 2023 Overwatch Threat Hunting Report.
Read this blog to learn about why threat hunting and intelligence are essential to detect and disrupt today’s adversaries, ultimately raising their cost of doing business: https://www.crowdstrike.com/blog/crowdstrike-debuts-counter-adversary-operations-team/

Urgent Care Required: The State of Healthcare Cybersecurity Nov 16, 2023

At a time when breaches make headlines daily, the healthcare sector is among the most popular adversary targets.

Cyberattacks against healthcare organizations have spiked in recent years, disrupting patient care, jeopardizing safety and privacy, and obstructing compliance with industry regulations. In this episode, Cristian is joined by Dennis Egan, director of healthcare services for CrowdStrike, and Drex DeFord, executive healthcare strategist at CrowdStrike, to discuss the impact of cyber threats against healthcare, challenges we see in the space, the urgent need for healthcare providers to strengthen their security and the steps they should take to defend against modern attacks.

Discover the targeting healthcare:

AQUATIC PANDA: https://www.crowdstrike.com/adversaries/aquatic-panda/

LABYRINTH CHOLLIMA: https://www.crowdstrike.com/adversaries/labyrinth-chollima/

Learn more about the cybersecurity issues Healthcare experiences: https://www.crowdstrike.com/blog/healthcare-experiences-cybersecurity-emergencies/

Iran’s Rise from Nascent Threat Actor to Global Adversary Nov 09, 2023

“Iran’s digital presence is something we don’t want to underestimate.”

Though its cyber activity has been making headlines during a dynamic past few weeks, Iran’s history as a major player in the threat landscape spans decades. In this episode, Adam and Cristian take you back to the days of Stuxnet and trace Iran’s evolution from nascent threat actor to prominent nation-state adversary. Tune in to learn how hacktivism has played a role in its history, why CrowdStrike uses “KITTEN” to categorize adversaries who operate on behalf of Iran, and how key political events and cyber threat activity have shaped its growth.

Inside China’s Evolution as a Global Security Threat Nov 02, 2023

China is the source of some of the most prolific and aggressive nation-state cyber activity organizations face.

Every business vertical, across every geography, is affected by China’s unrelenting focus on growth and power. In this episode, Adam and Cristian take you through the evolution of Chinese threat activity from the early 2010s through today, closely examining the myriad ways they seek to build influence, the industries they target along the way and the threat actors linked to Chinese cyberattacks.

Additional resources:

Download your copy of the 2023 Global Threat Report
Get your custom threat landscape
Read CrowdStrike's Research and Intel blogs

Have You Been Breached? Oct 19, 2023

A cyberattack is any security team’s worst nightmare — but the earlier a breach is detected, the faster you can respond and mitigate the damage.

In this episode, we’ll share the warning signs that could indicate a breach has occurred, the immediate next steps to take in the incident response process, and why having the right data is essential to a successful recovery.

Please note that all references to "Falcon" in this episode refer to the CrowdStrike Falcon® platform.

The Rise of the Access Brokers Oct 05, 2023

When an adversary seeks entry into an organization, they no longer need to develop their own vulnerability exploits or steal credentials.

Many turn to access brokers, the sellers of credentials, exploits and other tools threat actors can buy and use to gain initial access. In this episode, we discuss who access brokers are, how they gain and sell access, and their crucial role in the cybercrime ecosystem.

Inside the AI, Cloud and Platform Innovations Previewed at Fal.Con 2023 Sep 29, 2023

Adversaries are moving and innovating at a rapid pace — but so are we.

In this bonus episode, Adam and Cristian chat about the biggest announcements from Fal.Con, CrowdStrike’s annual conference, which took place last week in Las Vegas. Tune in to hear their take on new and developing technologies like Charlotte AI Investigator and Falcon Foundry, why they’re excited about the Bionic acquisition and some of the standout moments in an action-packed week.

Some brief disclaimers about products discussed in this episode:

Charlotte AI is a text-based interface in the Falcon platform; it does not support voice interaction at this time
Charlotte AI is currently available for private beta only. Watch CrowdStrike.com for future information about general availability
Charlotte AI Investigator is a feature of Falcon Raptor and designed for incident investigation. The Raptor release further accelerates the evolution of Charlotte AI, CrowdStrike’s generative AI cybersecurity analyst.

Adversaries and AI: Today’s Reality and Tomorrow’s Potential Sep 21, 2023

Artificial intelligence. It’s the hot topic in cybersecurity today.

Everyone is curious about it, excited about its use cases and nervous about the problems it may cause in the wrong hands. Adam and Cristian get right into the questions you want answered: How are adversaries using AI today? How might they use it in the future? What should businesses really be worried about? Tune in to learn the truth behind these questions — and more — in this breakdown of adversaries’ use of AI.

Ransomware Actors Mark Their Calendars for Back-to-School Sep 07, 2023

School is back in session — and adversaries have already done their homework.

They know educational institutions often lack the resources and expertise to keep up with the wave of ransomware, data extortion and other attacks pummeling their systems. Cristian and Adam examine why schools are a common target, the threats they face and how they can best defend themselves. In this episode, we also hear from special guest Jason Rooks, CIO at Parkway School District, who shares his perspective on fighting modern threats and creating a culture of cybersecurity.

Learn More:

There are five crucial security components security teams must consider for securing educational environments to allow them to have visibility, threat detection and response capabilities to stop adversaries. Download this eBook to learn about CrowdStrike’s expanded partnership with Google covering these components: 5 Easy Steps for School Cybersecurity .
Watch this on-demand CrowdCast to hear about the major ways that ransomware has evolved and understand how modern endpoint security solutions outsmart adversaries: Ransomware Isn’t Dead, It’s Growing Up: How to Evolve Your Defenses at Pace

Invisible Threats: Discovering, Tracking and Mitigating Vulnerabilities Aug 24, 2023

Vulnerabilities are the unlocked doors allowing adversaries a foothold into your organization.

Left unpatched, they provide an entryway for intruders to break in, move laterally and wreak havoc. This episode shares everything you want to know about vulnerability intelligence: What types of vulnerabilities are most common? How should organizations prioritize patching? What is an n-day flaw? Learn the answers to these questions, and more, from Adam, Cristian, and special guest Nina Padavil, Solutions Engineer and Threat Advisor at CrowdStrike.

Learn more about External Attack Surface Management challenges and recommendations: https://www.crowdstrike.com/cybersecurity-101/external-attack-surface-management/
Read CrowdStrike's latest blog covering how External Attack Surface Management enhances Cloud security: https://www.crowdstrike.com/blog/enhance-cloud-security-with-easm/

Intel-Led Threat Hunting with CrowdStrike Counter Adversary Operations Aug 10, 2023

“Scary and incredible.” “Terrifying.”

Adam and Cristian dig into new data from CrowdStrike’s recently formed Counter Adversary Operations Unit. A new report reveals adversaries are growing faster and smarter, with a focus on collecting identities and pilfering cloud environments.

In this episode, learn what’s behind the massive 583% year-over-year jump in Kerberoasting attacks and the 147% jump in access broker ads, as well as how to keep up with adversaries with breakout times down to 79 minutes.

Learn more:

Get your copy of the CrowdStrike 2023 Overwatch Threat Hunting Report: crowdstrike.com/threat-hunting-report

Is Microsoft’s Monoculture a National Security Risk? Aug 03, 2023

Multiple U.S. government agencies were recently breached after adversaries exploited vulnerabilities in Microsoft’s Azure Active Directory. With Microsoft vulnerabilities at the heart of some of the worst breaches in recent history, many in the cybersecurity industry are beginning to wonder: Do the dangers of the Microsoft monoculture outweigh the benefits?

In this special bonus episode, Adam and Cristian break down this breach and examine the history of breaches exploiting Microsoft technology on their path to answer a pivotal question: Has Microsoft's monoculture become a national security risk?

Learn more:

Your choice of security provider is critical to reducing cyber risk. Learn why customers trust CrowdStrike over Microsoft to protect their organization: https://www.crowdstrike.com/microsoft-risk/

Join an upcoming hands-on lab to experience why 8 out of 10 times, when an enterprise runs a proof of value test, they choose CrowdStrike: https://experiencethedifferencebetweencsandmsft.splashthat.com/

Cloud is the New Battleground Jul 27, 2023

Most organizations rely on cloud services or infrastructure to power their day-to-day operations — and adversaries know it. In this episode, we’ll explore how threat actors use the cloud to their advantage: how they breach cloud environments, the actions they take once they’re in, and the ways they use the cloud as a tool in their attacks. We’ll also discuss how organizations often unknowingly put their cloud environments at risk and the steps they can take to strengthen their cloud security.

The cloud is the new attack surface. Get an overview of today’s cloud threat landscape and actionable steps to combat cloud adversaries in the on-demand replay of CrowdStrike’s Cloud Threat Summit. Watch now: https://www.crowdstrike.com/events/cloud-threat-summit/

Who is the Adversary? Jul 13, 2023

Behind every cyberattack, there is an adversary. These adversaries target organizations large and small, across all industries, to steal money, information and more from their victims.

Understanding these adversaries can help you protect your business — and we’re here to help. In the first episode of the Adversary Universe Podcast, we introduce you to our expert hosts, Adam Meyers and Cristian Rodriguez, and begin to tell the story of modern adversaries: who they are, how they’re tracked, and why you should learn more about them.

Additional resources:

Learn more about the podcast: https://www.crowdstrike.com/adversaryuniversepodcast
Download your copy of the 2023 Global Threat Report: https://www.crowdstrike.com/global-threat-report/
Get your custom threat landscape: https://www.crowdstrike.com/adversaries
Read CrowdStrike's Research and Intel blogs: https://www.crowdstrike.com/blog/category/threat-intel-research/
Meet the adversaries that evade traditional AV: https://www.crowdstrike.com/resources/white-papers/modern-adversaries-and-evasion-techniques-ebook/

Adversary Universe Podcast Trailer Jun 28, 2023

Welcome to the Adversary Universe podcast, the best place to learn about the threat actors behind today’s cyberattacks.

We’ll dig deep into the adversaries we’re tracking here at CrowdStrike, the tactics and techniques they employ, threats we’ve seen in the wild, and most importantly, how all of this information can help you better defend your organization.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Adversary Universe Podcast

Related Podcasts

Links

Stay Connected