DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

Investigating Wine Fraud with the Ransomware Sommelier Sep 27, 2022

Show notes

All for wine, and wine for all. But only if it isn’t fraudulent.
In July 2022, Allan Liska, an analyst at Recorded Future and wine expert, released some new research on counterfeit wine, spirits and cheese. Allan joins the show as our first ever external guest to give us an overview of what that research entailed and the different types of wine fraud he’s observed. By the end of this episode, we’ll all be partners in cybercrime and wine.
Join us as we discuss:
What is wine fraud and the different types of fraud that fall under the counterfeit umbrella
How the pandemic impacted wine fraud due to happy hours
Some of the techniques that wine fraudsters are using to try to legitimize the fake wines
Allan’s favorite fall wines and recommendations for food pairings
Check out these resources we mentioned:
https://www.recordedfuture.com/lockdown-rise-wine-domain-scammer
https://www.recordedfuture.com/counterfeit-wine-spirits-cheese
https://www.proofpoint.com/us/blog/threat-insight/bec-taxonomy-invoice-fraud
https://www.decanter.com/wine-news/worlds-most-expensive-bottle-claimed-fake-as-renowned-collector-sued-93457/#:~:text=A%20billionaire%20Florida%20wine%20collector,to%20Thomas%20Jefferson%20are%20fakes
https://www.cbsnews.com/news/billionaire-spends-35m-to-investigate-400k-wine-fraud/
https://kermitlynch.com/
https://twitter.com/uuallan/status/1561124207727153153
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Hot off the Press: APT Actors Posing as Journalists Sep 13, 2022

Show notes

Send us fan mail!

In this episode, Joshua Miller and Michael Raggi, Senior Threat Researchers at Proofpoint, join the show to discuss APT groups targeting and impersonating journalists. Joshua, Michael, and Crista discovered during their research how APT actors use journalist and their leads as a form of espionage to collect sensitive information.
Join us as we discuss:
Proofpoint’s unique report on APTs targeting journalists and insight into the motivations behind these attacks
Understanding the “why” behind threat actors targeting or posing as journalists and media organizations
The most common methods APT actors use in these campaigns to target or pose as journalists
Stories about threat actors from China, Iran, Turkey, and more
Check out these resources we mentioned:
https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists
Previous episode with Joshua: https://podcasts.apple.com/us/podcast/apt-attribution-trials-and-tribulations-from-the-field/id1612506550?i=1000571269986
Previous episode with Michael: https://podcasts.apple.com/us/podcast/web-bugs-the-tubthumping-tactics-of-chinese-threat/id1612506550?i=1000558705940
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Misfits Managed: Breaking Down Misfit Malware Aug 23, 2022

Show notes

Send us fan mail!

In this episode, Sara Sabotka Senior Threat Researcher on the field-facing team at Proofpoint, joins the show to chat about Misfit Malware. Although it is sometimes referred to as commodity malware, this kind of malicious software is anything but boring. You’ll want to stick around to find out who belongs on the Island of Misfit Malware and the importance of paying attention to the little gang of misfits.
Join us as we discuss:
How do foreign threat actors go about acquiring commodity malware and how much does it cost?
Why Misfit Malware is sometimes easily overlooked by security researchers and defenders
Key characteristics of lures that are commonly used by threat actors who use Misfit Malware
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Art of Threat Detection Engineering Aug 09, 2022

Show notes

Send us fan mail!

In this episode, Konstantin Klinger, Senior Security Research Engineer at Proofpoint, joins the show to chat about his role on the threat research team, focusing on DDX (Detonation, Detection, and Extraction). You won’t want to miss his breakdown of the Pyramid of Pain and how to utilize it for threat detection engineering.
Join us as we discuss:
Real-life examples of complex attack chain with multiple steps and how to they can be detected
Utilizing the Pyramid of Pain for threat detection engineering
How to write detections for geofencing
The perks of incorporating automated MITRE ATT&CK detections into your sandbox
Resources:
https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-uses-spanish-language-lures-distribute-seldom-observed-bandook
https://www.proofpoint.com/us/blog/threat-insight/new-ta402-molerats-malware-targets-governments-middle-east
https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage
http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

APT Attribution: Trials and Tribulations From the Field Jul 26, 2022

Show notes

Send us fan mail!

In this episode, Joshua Miller and Zydeca Cass, Senior Threat Researchers at Proofpoint, join the show to discuss attribution, specifically APT actor attribution. Joshua and Zydeca dive into their experiences of attribution successes and failures, sharing tales of threat actors impersonating Russian opposition leaders and an Iranian kidnapping plot in New York. As Crista says, the good, the bad and the ugly.
Join us as we discuss:
Understanding the difference between the two types of attribution
How attribution can be used in e-crime versus state-aligned investigation
Stories from Josh and Zydeca of threat actors they are tracking based in Russia and Iran
Check out these resources we mentioned:
https://twitter.com/ChicagoCyber/status/1521492543707430912
https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html
https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-kidnapping-conspiracy-charges-against-iranian
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Dark-Side of Cryptocurrency Jul 12, 2022

Show notes

Send us fan mail!

In this episode, Jared Peck, Senior Threat Researcher at Proofpoint, explains cryptocurrency and how bad actors are causing trouble with these new decentralized, anonymous currencies.
Join us as we discuss:
Credential harvesting and phishing
Malicious campaigns and extortion
Digital money laundering
Resources:
https://www.proofpoint.com/us/blog/threat-insight/how-cyber-criminals-target-cryptocurrency
https://twitter.com/ChicagoCyber/status/1521492543707430912
https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html
https://www.proofpoint.com/us/podcasts/threat-digest#113131
https://www.proofpoint.com/us/blog/threat-insight/advance-fee-fraud-emergence-elaborate-crypto-schemes
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

A Day in the Life of a Threat Researcher: Emerging Threats Edition Jun 21, 2022

Show notes

Send us fan mail!

Tony Robinson, Threat Researcher, joins the podcast to share his expertise as a member of the Emerging Threats team at Proofpoint. Tony gives us an inside look into a day in his life as he and his teammates discover new strains of malware, respond to major vulnerabilities, and ensure that customers are protected. He also shares his advice for those interested in a career in Threat Research.
Join us as we discuss:
How the Emerging Threats team at Proofpoint impacts customers daily lives
Using cybersecurity rule-sets to find new strains of malware
Utilizing the open source security community to write new rules and stay up to date on the developing threat landscape
The difference between rules detecting threat behaviors vs. indicators of compromise
Check out these resources we mentioned:
https://www.proofpoint.com/us/products/advanced-threat-protection/et-intelligence
https://twitter.com/da_667/status/1512255056573255693
https://twitter.com/da_667/status/1503876806478385168
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Buzz on Bumblebee Malware Jun 07, 2022

Show notes

Send us fan mail!

Float like a butterfly. Sting like Bumblebee malware.
In this episode, Kelsey Merriman, Threat Research Analyst, and Pim Trouerbach, Senior Reverse Engineer, both with Proofpoint, share their insights from their research of the new malware downloader called Bumblebee. You won’t want to miss their breakdown of Bumblebee’s unique characteristics and their predictions of how its features will develop over time.
Join us as we discuss:
The difference in tracking Crimeware versus AAPT
How threat actors are using Bumblebee
The exit of BazaLoader malware and its connection to Bumblebee
Check out these resources we mentioned:
https://www.proofpoint.com/us/blog/threat-insight/isnt-optimus-primes-bumblebee-its-still-transforming
https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Social Engineering: How Threat Actors Manipulate Their Targets May 24, 2022

Show notes

Send us fan mail!

Threat actors always take the path of least resistance to their payday. But it's a mistake to think they aren't willing to put in the work to get a human to hand feed them.
Their attempts to manipulate their targets into taking action are called social engineering. What role do people play in cybersecurity?
In this episode, Daniel Blackford, Threat Researcher at Proofpoint, explains how bad actors capitalize on our humanity to attack us.
Join us as we discuss:
What lies beneath 95% of cyber attacks
The two factors that reduce people's sensitivity to threats
When social engineering content might be waiting for you
Check out these resources we mentioned:
https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453
https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media
https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steal
https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453
https://www.bankinfosecurity.com/kansas-man-faces-federal-charges-over-water-treatment-hack-a-16328
https://twitter.com/selenalarson/status/1224674562882834432
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Paying Attention to BEC: The Most Costly Threat by Individual Losses May 10, 2022

Show notes

Send us fan mail!

When you think about the most costly threat by personal losses, most people will assume ransomware.
The real threat, however, is business email compromise (BEC). But why aren’t more companies talking about it, then?
In this episode, Tim Kromphardt and Jake G. explain BEC and why organizations need to start paying more attention.
Join us as we discuss:
The definition of BEC & why companies are paying so little attention
Using Supernova to defend against email attacks
Reporting on employment fraud
Check out these resources we mentioned:
BEC Taxonomy: https://www.proofpoint.com/us/blog/threat-insight/bec-taxonomy-proofpoint-framework
Supernova: https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-launches-industrys-first-cloud-native-information-protection-and
IC3 Report: https://www.ic3.gov/
TOAD blog post: https://www.proofpoint.com/us/blog/threat-insight/caught-beneath-landline-411-telephone-oriented-attack-delivery
Railroad theft: https://www.cnn.com/2022/01/14/economy/la-freight-railroad-theft/index.html
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Our TOPPODCAST Picks

Follow Us

Stay Connected

DISCARDED: Tales From the Threat Research Trenches

Related Podcasts

Links

Stay Connected