DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

Threat Actor Theater: TA2541, TA558, and the Cyber Heist Crew TA582 Jul 29, 2025

Show notes

Hello to all our cyber pals! In this episode of Discarded, host Selena Larson and co-host, Tim Kromphardt, are joined by Joe Wise, Senior Threat Researcher at Proofpoint for a deep dive into the chaotic brilliance of mid-tier eCrime actors—including the elusive TA582.

We explore recent activity from TA2541 and TA558—two groups known for their uncanny consistency and precision targeting—before shifting focus to TA582: a standout in today’s threat landscape. TA582’s multilayered, region-specific lures (think vintage car sales and fake speeding tickets) and complex delivery models are impressive compared to your typical cybercriminal.

Topics Include:

🔍 What you’ll hear:

How TA2541 and TA558 maintain eerily consistent lures and targeting year after year
The regional flavor behind lures in Latin America and Europe—especially during tax season
Why TA582 feels like a digital jigsaw puzzle, with simultaneous email, web inject, and compromised site vectors
A breakdown of TA582’s evolving payloads, from GhostWeaver to Interlock RAT
The surprising links between threat actor collaboration, initial access brokers, and shifting loader trends
How weird or silly variable names can enable threat actor tracking
And yes—13 URLs that needs the Tron soundtrack playing in the background to explore

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

10 Things I Hate About Attribution: A Clustering Conundrum Jul 15, 2025

Show notes

Send us fan mail!

Hello to all our cyber detectives and pedantic CTI friends! In this episode of Discarded, host Selena Larson is joined by Greg Lesnewich, Staff Threat Researcher at Proofpoint for a behind-the-scenes look at one of the most frustratingly fascinating attribution cases yet.

What begins as a lighthearted rant: “10 Things I Hate About Attribution,” quickly turns into a deep dive into the murky overlap between TA829 (aka RomCom), TA289, and the elusive GreenSec cluster. From TransferLoader and malware panels to REM proxy infrastructure and attack chain similarities, Greg and Selena dissect the breadcrumb trail that led to a 25-page blog, a mountain of malware chains (Dusty Hammock? Single Camper?), and an attribution headache.

Topics Include:

TA829 (aka RomCom) and the elusive GreenSec cluster: What’s the difference?
Vertical targeting overlap (and divergence)
Malware breakdown: TransferLoader vs. RomCom and related malware
Use of REM proxy and rebrand.ly infrastructure
Attribution logic and the perils of shared tooling
Bonus: Existential mysteries and karaoke mic commentary

The attribution game isn’t always about getting it right—it’s about asking better questions. Join us in the mess, and keep connecting the dots.

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

Comic Sans and Cybercrime: Inside North Korea’s Global Cyber Playbook Jul 01, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Pals! In this episode of Discarded, host Selena Larson and co-host Sara Sabotka are joined by Saher Naumaan and Greg Lesnewich, teammates on the espionage threat research team at Proofpoint to unravel the multifaceted—and often bizarre—world of North Korean cyber operations.

The team explores:

What sets DPRK’s threat actors apart from other nation-state groups
A closer look at North Korea’s cyber and physical support for Russia in Ukraine
How cyber activity plays a central role in North Korea’s national strategy—not just a supporting one
The phishing-heavy tactics of groups like TA427 (“Old Reliable”) and the emergence of oddball clusters like “Contagious Interview” and “UNK RageQuit”
How North Korean actors blur the lines between espionage and financially motivated cybercrime
The murky world of North Korean IT workers infiltrating global tech companies under false identities—raising critical questions about workplace exposure, ethics, and potential defections
The surprising ways some of these operatives sabotage themselves, including infections with common malware that expose their digital behavior
And yes, a Microsoft spoofing campaign actually using Comic Sans

North Korean cyber activity is evolving fast and they explain why it deserves far more attention than it gets.

Resources Mentioned:

https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front

https://spycloud.com/blog/spycloud-march-cybercrime-update/

https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-threat-insight-paper-triple-threat-N-Korea-aligned-TA406-steals-scams-spies.pdf

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

Signatures and Surprises: Inside the Emerging Threats Team Jun 18, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Masked Vigilantes! In this episode of Discarded, host Selena Larson and co-host Tim Kromhardt are joined by James Emery-Callcott, a Security Researcher on Proofpoint’s Emerging Threats team, for an insider’s look at the technical, tactical, and collaborative forces shaping modern network detection.

James takes us behind the curtain of rule writing, CVE coverage, and malware detection, breaking down how signatures are developed, validated, and deployed to protect against a constantly shifting threat landscape. From the fading heyday of exploit kits to the rise of infostealers and ClickFix, we explore how detections evolve—and why the most persistent threats often hinge on the fundamentals of networking.

You’ll also hear how the team maps detection rules to frameworks like MITRE ATT&CK and CISA KEV, using metadata tags to reduce alert fatigue and prioritize real-world risks. James shares why this kind of tagging isn’t just technical polish—it’s operational gold.

But detection doesn’t happen in a vacuum. James explains how the community—through Discord chats, support tickets, and collaborative research—plays a vital role in surfacing false positives, sharing POCs, and suggesting metadata improvements.

Bonus highlights include:

Why writing reliable detection rules is still too nuanced for AI
The anatomy of a CVE rollout (and the surprising role of an Xbox controller)
Signature performance testing and hardware challenges
Why older vulnerabilities still matter
A sneak peek at a free Suricata training series in the works

Whether it’s a shoutout to Tony for pushing tagging innovation or a nod to students eager to get started, the message is clear: everyone can contribute to better detection.

Resources Mentioned:

CrazyHunter: https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html

https://www.proofpoint.com/us/blog/threat-insight/emerging-threats-updates-improve-metadata-including-mitre-attck-tags

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

DBIR Deep Dive: Identity, Access, and the Expanding Attack Surface Jun 04, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Stars! Join host Selena Larson, and guest host, Sarah Sabotka, as they sit down with Alex Pinto, Associate Director of Threat Intelligence at Verizon Business and the lead author behind the industry-defining Verizon Data Breach Investigations Report (DBIR). Together, they unpack the most pressing findings from the brand new VZDBIR, offering a behind-the-scenes look at how the reports are built—and what they reveal about today’s rapidly evolving threat landscape.

Alex shares how the editorial strategy behind the DBIR helps translate raw data from 100+ contributors into actionable insights and compelling narratives.

The conversation dives into:

The surge in zero-day vulnerabilities and growing threats tied to network edge devices
Why third-party risk is skyrocketing, and what that means for vendor relationships
How ransomware groups are maturing and reinvesting like modern businesses
The alarming rise of credential abuse via MFA-bypassing phishing kits and information stealers
Why identity is now the primary target—and how defenders can introduce friction without killing usability
The limitations of current threat categorization and whether full attack chain visualizations should be next

Whether you're here for the acronyms, the insights, or just want to win at cyber threat bingo, this episode is a must-listen for anyone navigating the modern security landscape.

🎧 Tune in to hear why “DBIR Day” matters—and how this year’s findings may be more personal than ever.

Resources Mentioned:

https://www.verizon.com/business/resources/reports/dbir/

For more information about Proofpoint, check out our website.

The ClickFix Convergence: How Threat Actors Blur the Lines May 14, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Spring Chickens! Join host Selena Larson, and guest host, Sarah Sabotka, as they chat with Saher Naumaan, Senior Threat Researcher at Proofpoint, for a deep dive into how modern espionage and cybercrime are increasingly blurring lines.

At the center of the conversation is ClickFix—a fast-evolving social engineering technique originally used by cybercriminals but now adopted by espionage actors across at least three countries in just 90 days.

We explore:

how threat actors are borrowing each other’s tactics, techniques, and procedures (TTPs), creating “muddled attribution” as espionage groups mimic high-volume e-crime methods
how these techniques are being tailored to target high-value, often non-technical individuals
what defenders can do in the face of increasingly sophisticated psychological attacks

Resources Mentioned:

https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix

https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

The Art of the Innocent Ask: How Threat Actors Use Benign Conversations Apr 29, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Spring Chickens! Join host Selena Larson and guest hosts, Tim Kromphardt and Sarah Sabotka, both Senior Threat Researchers at Proofpoint.

These top sleuths crack open Proofpoint’s new Human Factor series and explore one of the most deceptively dangerous tactics in a threat actor’s playbook: the benign conversation.

What exactly is a benign conversation—and why is it anything but harmless? Whether it’s a simple “Do you have a minute?” or a seemingly legit job offer, these messages are often the opening moves in complex social engineering attacks used for fraud, malware delivery, and even nation-state espionage.

The team dives into:

The top five fraud-related benign conversation themes, including the rise of advanced fee fraud
Real-world examples of job scams, gift card requests, and a Taylor Swift-themed lure
The difference between financially motivated lures and espionage-style social engineering
How Iranian and North Korean threat actors are perfecting the art of trust-building through impersonation and tailored messages
TOAD scams (Telephone-Oriented Attack Delivery) and the power of fear and urgency
The critical role of spoofing in making these attacks believable
The human toll and psychological manipulation behind scams like pig butchering—and why acknowledging the abuse behind them matters

From hijacked contact forms and fake antivirus invoices to AI-generated phone calls and scam compounds, this episode blends serious security insight with Friday vibes and candid discussion.

Whether you're a seasoned threat analyst or just here for the “lure-palooza,” you’ll walk away with a sharper eye for red flags—and a deeper understanding of the evolving cyber threat landscape.

Resources Mentioned:

🔍 [Read the full report] https://www.proofpoint.com/us/resources/threat-reports/human-factor-social-engineering

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

Diving Into Cyber Journalism: FOIA, Fraud, and the Fight Against Online Threats Apr 09, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Cherry Blossoms! Join host Selena Larson and guest host, Tim Kromphardt, a Senior Threat Researcher, as they chat with Andrew Couts, Senior Editor, Security and Investigations at WIRED.

Andrew shares insights into his work overseeing cybersecurity coverage and investigative reporting, collaborating with newsrooms, and uncovering the hidden threats lurking in the digital world.

We dive into how cybersecurity and privacy reporting has evolved, the growing risks posed by data collection and surveillance, and the challenges of informing the public around security experimentation.

We also discuss:

Recent investigations on ad tech, police drone surveillance, and the unintended consequences of data tracking
The rise of "pig butchering" scams and the difficulties in shutting them down
How the Freedom of Information Act (FOIA) serves as a powerful tool for uncovering hidden government actions
The real-world dangers journalists face when reporting on cybercriminals—such as swatting and online retaliation
The double-edged sword of privacy—how encryption and digital anonymity can both protect individuals and make it harder to track cybercriminals

Join us for a fascinating deep dive into the world of digital security, investigative journalism, and the real-life implications of living in an era where our data is constantly at risk.

Resources Mentioned:

Leveling Up Your Cybersecurity–WIRED Guide

https://www.wired.com/story/phone-data-us-soldiers-spies-nuclear-germany/

https://www.wired.com/story/the-age-of-the-drone-police-is-here/

https://www.wired.com/story/starlink-scam-compounds/

https://www.wired.com/story/alan-filion-torswats-swatting-arrest/

https://www.wired.com/story/no-lives-matter-764-violence/ (Content warning: self-harm, violence)

https://www.wired.com/story/the-wired-guide-to-protecting-yourself-from-government-surveillance/

https://www.wired.com/story/how-to-take-photos-at-protests/

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

RMM Tools: The New Cybercrime Trick? Mar 25, 2025

Show notes

Send us fan mail!

Hello to all our Remote Cyber Pals! Join host Selena Larson and guest host, Tim Kromphardt, a Senior Threat Researcher, as they chat with Staff Threat Researcher, Ole Villadsen, from Proofpoint. They explore the broader shift from traditional malware to commercially available tools that fly under the radar and how cybercriminals are increasingly abusing Remote Monitoring and Management (RMM) tools (sometimes called Remote Access Software) to gain initial access in email-based attacks.

Topics Covered:

The growing use of such tools like ScreenConnect, Atera, and NetSupport in cyberattacks
How threat actors are shifting from traditional malware loaders to commercially available tools
TA583’s adoption of RMM tools as a primary attack method
The role of social engineering in phishing lures, including Social Security scams
The impact of cybersecurity influencers and scam-baiting YouTubers on threat awareness
The ongoing arms race between cybercriminals and defenders

From stealthy intrusions to shifting cybercrime trends, this conversation uncovers the critical threats organizations face in 2025.

Resources Mentioned:

https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

Your Best Defense against Social Engineering: The Gray-Matter Firewall Mar 11, 2025

Show notes

Send us fan mail!

Hello to all our Cyber Pals! Join host Selena Larson and guest hosts, Sarah Sabotka and Tim Kromphardt, both Senior Threat Researchers from Proofpoint, as they dive into the realities of current social engineering schemes —especially during high-risk times like tax season. Cybercriminals exploit fear, urgency, and excitement to manipulate victims, from IRS impersonation scams and fraudulent tax payment requests to deepfake cons and TikTok frauds.

Our hosts dive into real-world examples, including:

tax-themed phishing attacks
tech support scams targeting the elderly
job scams leveraging Taylor Swift’s tour

They explore how AI is reshaping fraud tactics, why scammers still rely on outdated schemes like overseas financial windfalls, and how platforms like WhatsApp and Telegram play a role in modern cybercrime.

Tune in to learn how these scams work, why they succeed, and—most importantly—how you can protect yourself. Check out our show notes for additional resources, and don’t forget to share this episode with friends and colleagues!

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

Our TOPPODCAST Picks

Follow Us

Stay Connected

DISCARDED: Tales From the Threat Research Trenches

Related Podcasts

Links

Stay Connected