DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

Web Bugs & the Tubthumping Tactics of Chinese Threat Actor TA416 Apr 26, 2022

Show notes

Chinese Threat Actor TA416, otherwise known as Mustang Panda, has been active for a long time, and every time they get knocked down, they get up again.
In this episode, Michael Raggi, Senior Threat Researcher, and Pim Trouerbach, Senior Reverse Engineer, both with Proofpoint, give us an overview of TA416 — the “Tubthumping” villains of the threat landscape.
Join us as we discuss:
The evolving tactics of TA416
PlugX malware and control flow flattening
Tips for dealing with emerging threats
Check out these resources we mentioned:
Michael’s Twitter: https://twitter.com/aRtAGGI/status/1501030779480125441
https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european
https://www.theregister.com/2022/03/09/china_apt41_mandiant_usaherds/
Tubthumping by Chumbawamba
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Defending Against Cyber Criminals: Emotet’s Resurrection & Conti’s Implosion Apr 12, 2022

Show notes

Send us fan mail!

Cybercriminals. They’re just like us.
With the Russia Ukraine conflict, Conti found itself at odds with internal team members over the issue — Eventually leading to self destruction.
Which begs the question: Are these organizations as impenetrable as we thought?
In this episode, we hear from Andrew Northern, Senior Threat Researcher at Proofpoint, about the resurrection of the Emotet malware, the Conti implosion, and advice to cyber defenders.
Join us as we discuss:
The journey leading to Emotet’s return
The importance of the Conti group leaks
What defenders should be thinking about against cyber threats
Check out this resource we mentioned:
Andrew's Twitter: https://mobile.twitter.com/ex_raritas
https://acn-marketing-blog.accenture.com/wp-content/uploads/2022/03/UPDATED-ACTI-Global-Incident-Report-Ideological-Divide-Blog-14MARCH22.pdf
https://www.wired.com/story/conti-ransomware-russia/
https://www.cnn.com/2022/03/30/politics/ukraine-hack-russian-ransomware-gang/index.html
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Threat Actor 2541: The Latest Tricks & Patterns Mar 29, 2022

Show notes

Send us fan mail!

How are threat actors like Olympic snowboard halfpipe athletes?
When their good tricks get stolen by competitors, they add new ones to their repertoire.
In this episode, we hear from Joe Wise, Threat Researcher at Proofpoint, about the latest tricks from TA2541 (and why it’s so fun to research that group).
Join us as we discuss:
Changes that TA2541 has made over time
Their current strategies and patterns
Snowboarding, Home Alone, and what makes TA2541 unique
Check out this resource we mentioned:
Charting TA2541's Flight | Proofpoint US
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

The Troubling Rise of MFA Kits Mar 15, 2022

Show notes

Send us fan mail!

Until recently, threat actors haven’t really invested much time in MFA phish kits because not a lot of people used MFA. (Everyone needs MFA, full stop.)
Consequently, threat actors are using more advanced multi-factor authentication-enabled phish kits.
Find out why in our first episode of DISCARDED, where we hear from Tim Kromphardt, Email Threat Researcher at Proofpoint, about why MFA kits are sort of like Justin Bieber ticket thieves.
Join us as we discuss:
How MFA kits differ from ordinary phish kits
What threat actors and researchers have in common
A technical dive into transparent reverse proxies
Why you need multifactor authentication despite the rise of MFA kits
Check out these resources we mentioned during the podcast:
MFA PSA, Oh My!
Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits
Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Discussing RTF Template Injection: A Malicious Phishing Attempt Mar 02, 2022

Show notes

Send us fan mail!

If you asked for M&M’s and received Skittles, you might pop a few in your mouth, but it won’t take long to realize something’s off.
This is exactly what’s happening with RTF files: Instead of the intended attachment, unaware companies are delivering these files and realizing later that they were actually malicious.
On this episode of Protecting People, hosts Selena Larson and Crista Giering chat with Michael Raggi, Senior Threat Research Engineer at Proofpoint, about RTF files, template injection, and campaigns using the technique in an effort to make sure customers aren’t being surprised with “Skittles.”
Join us as we discuss:
The importance of template injection
Campaigns using the technique
Widespread adoption of the RTF injection
Mitigating and monitoring the technique
Resource mentioned:
https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread
For more episodes like this one, subscribe to us on Apple Podcasts, Spotify, and the Proofpoint website, or just search for Protecting People in your favorite podcast player.

Our TOPPODCAST Picks

Follow Us

Stay Connected

DISCARDED: Tales From the Threat Research Trenches

Related Podcasts

Links

Stay Connected