DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

A Venture Mindset: North Korean Actors Go Beyond Espionage Feb 21, 2023

Show notes

We’ve discussed a handful of APT actors on the Discarded podcast, like Russia, Iran, China and Turkey. In this episode, we dive into the isolated world of North Korean aligned actors with Sr. Threat Researcher, Greg Lesnewich.
In this episode, we discuss the following:

The role DPRK’s culture of isolation has played in its approach to cyber espionage
Overview of TA444 and what makes them different in the landscape
TA444s relationship with cryptocurrency

Resources:

Why Do We Click? Understanding the Psychology of Social Engineering Feb 08, 2023

Show notes

Send us fan mail!

Social engineering is a technique used by attackers to manipulate individuals into performing actions that may put their personal or sensitive information at risk. Attackers know the biggest weakness in cybersecurity is humans—and with this, leverage socially engineered phishing emails to manipulate the human psychology. In this episode, we have Dr. Bob Hausmann, Learning and Assessment Architect, joining us to discuss the psychology behind user engagement with phishing.
In this episode, we discuss the following:

The Zone of Proximal Development
What the Adaptive Learning Framework is
Where ethical lines should be drawn with phishing simulations
Psychology of social engineering in threat actor approaches

Additional resources:

https://www.proofpoint.com/us/blog/security-awareness-training/adaptive-learning-framework-security-awareness-training
https://www.forrester.com/report/the-future-of-security-awareness-and-training/RES178339
https://www.ncsc.gov.uk/blog-post/telling-users-to-avoid-clicking-bad-links-still-isnt-working
https://twitter.com/threatinsight/status/1612888307645485086
Daniel Pink Autonomy, Mastery & Purpose: https://www.youtube.com/watch?v=rbR2V1UeB_A&feature=youtu.be
https://www.proofpoint.com/us/blog/threat-insight/exploiting-covid-19-how-threat-actors-hijacked-pandemic
Stay Puft Marshmallow Man: https://www.youtube.com/watch?v=2zhDfUAQSbs&ab_channel=Ghostbusters
2023 State of the Phish Report: Publishing on February 28, 2023 on proofpoint.com

New Year, New Threats: Prepping for the 2023 Threat Landscape Jan 24, 2023

Show notes

Send us fan mail!

A new year has arrived! The 2022 threat landscape had some extremely notable activity, from Russian APT actors to Microsoft's blocking of macros. We saw a lot and can guarantee threat actors won't be slowing down in 2023 and will continue to be a major threat to organizations. In this episode, Threat Research Managers, Alexis Dorais-Joncas, Rich Gonzalaz and Daniel Blackford, join us to share their perspectives on the 2023 threat landscape. Join us as we discuss the following:

What our experts are anticipating in 2023
How vulnerabilities help in detection creation
Emerging techniques that could be used by malicious actors

Additional resources:

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Confidence, confusion, cashout: How pig butchering is blindsiding victims Jan 10, 2023

Show notes

Send us fan mail!

Threat actors are disarming their victims with a new approach: The long game. Instead of asking for money or gift cards upfront, they build a connection and confidence until they cash in on the big payout. In this episode of Discarded, Selena Larson and Crista Giering are joined by Proofpoint team members: Tim Kromphardt, Email Fraud Researcher, and Genina Po, Threat Analyst, to discuss socially engineered attacks and how victims are tricked.
Join us as we discuss:

Understanding what pig butchering is
How the scam blindsides victims
The evolution of the fraud from China to other countries in Asia

Resources mentioned:

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Holiday Happy Hour: 12 Faves of Threat Research Dec 28, 2022

Show notes

Send us fan mail!

As the end of year is rapidly approaching, it’s important to reflect back on some of the top learnings for the year. In this special holiday edition of The Discarded podcast, Selena and Crista are joined by Mindy Semling, Podcast Producer at Proofpoint, to answer questions on their favorite things from threat research over the past year — from blogs to malware to holiday songs, we cover it all. Join us as we discuss:

Celebrating the year
The 12 favorites
A thank you to our guests

Resources mentioned:

https://www.proofpoint.com/us/blog/threat-insight/exploiting-covid-19-how-threat-actors-hijacked-pandemic
https://www.proofpoint.com/us/blog/threat-insight/broken-dreams-and-piggy-banks-pig-butchering-crypto-fraud-growing-online
https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
https://medium.com/mitre-attack/intelligence-failures-of-lincolns-top-spies-what-cti-analysts-can-learn-from-the-civil-war-35be8d12884
For more research, check out the Proofpoint Threat Insight blog: https://www.proofpoint.com/us/blog/threat-insight

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

AMA Answers From the Threat Research Trenches Dec 13, 2022

Show notes

Send us fan mail!

In this highly entertaining episode of DISCARDED, Selena Larson and Crista Giering host a wild round of “Ask Me Anything,” with Sherrod DeGrippo, VP of Threat Research and Detection, and Daniel Blackford, Threat Researcher at Proofpoint.
Featuring insightful questions from listeners and former guests, these industry experts cover a wide range of topics, from silly to serious.
Join us as we discuss:
The most boring malware and common threat actor mistakes
New developments in Ukraine and the Global South
A proliferation of mobile malware and sports-related attacks
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Many-Faced Threat: Multi-Persona Impersonation (MPI) In Your Inbox Nov 29, 2022

Show notes

Send us fan mail!

Social proof is a potent tool, even in the absence of direct support. When someone is pressured to do something in the presence of trusted peers, they are more likely to follow through unless someone objects. Unfortunately, threat actors have taken notice and are investing significant time and resources into looking like a trusted party to gain access to your personal information.
Josh Miller and Sam Scholten join this episode to share their experiences with the evolving intellect of attackers and their multifaceted breach strategies. Using multi-persona impersonation (MPI), attackers establish multiple accounts and increase trust by manipulating social validation — a psychological tool.
Join us as we discuss:
The evolution of MPIs
Email fraud taxonomy
The role of MPI in business email compromise
Resources:
https://www.proofpoint.com/us/blog/threat-insight/ta453-uses-multi-persona-impersonation-capitalize-fomo
https://www.proofpoint.com/us/blog/threat-insight/bec-taxonomy-proofpoint-framework
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Machine Learning Is a Party With Camp Disco! Nov 08, 2022

Show notes

Send us fan mail!

In this episode, Dr. Zachary Abzug, Manager and Tech Lead of Data Science at Proofpoint joins the show to discuss a machine learning enabled tool called Camp Discovery, AKA Camp Disco and the importance of the human interaction required for making use of machine learning in malware detection.
Join us as we discuss:
What exactly Camp Disco is and the need/idea behind its creation
How Camp Disco played a role in the discovery of Chocolatey threat activity
Why Camp Disco uses its own neural network language model instead of an existing language model
Natural Language Processing and how to teach a computer to speak “malware”
Check out these resources we mentioned:
https://www.proofpoint.com/us/blog/engineering-insights/using-neural-network-language-model-instead-of-bert-gpt
https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails
https://www.proofpoint.com/us/blog/threat-insight/emotet-tests-new-delivery-techniques
https://www.proofpoint.com/us/company/careers
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Reservation Confirmed: Threat Actors Visiting the Hospitality World Oct 25, 2022

Show notes

Send us fan mail!

In this episode, Joe Wise, Threat Researcher at Proofpoint, joins the show to discuss his and Selena’s research into a small e-crime actor, TA558 and its targeting against the hospitality and travel e-crime sector since at least 2018.
Join us as we discuss:
Classifying threat actors and how it relates to s’mores
Understanding e-crime vs. APT actors
Why hospitality and travel e-crimes are still successful
TA558’s TTPs and how their consistencies have aided in Proofpoint’s attribution of their activity over the years
Joe shares his theories on why TA558 uses so many different malware types
Check out these resources we mentioned:
https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel
https://embed.sounder.fm/play/299042
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Hallow-queen of Cybersecurity: Spooky and Sweet Takes with Sherrod DeGrippo Oct 11, 2022

Show notes

Send us fan mail!

Cybersecurity doesn't have to be spooky this Halloween.
In this episode, Sherrod DeGrippo, VP of Threat Research and Detection at Proofpoint, joins the show to discuss all things cybersecurity awareness so you can be prepared, not scared, this October. So grab a sweet treat and pull up a seat, the Hallow-queen is about to give her hot takes!
Join us as we discuss:
The growing risk of TOADs (Telephone Oriented Attack Delivery)
Benign phishing reconnaissance emails by threat actors
What you need to know to adapt to this ever changing threat landscape
Bring awareness to cybersecurity this October, even on ghost tours
Check out these resources we mentioned:
https://www.proofpoint.com/us/cybersecurity-awareness-hub
https://www.proofpoint.com/us/products/advanced-threat-protection/et-intelligence
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!