DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

MITRE ATT&CK Evolves with Cyber Threat Sophistication Nov 29, 2023

Show notes

Take a deep dive with us into the incomparable MITRE ATT&CK Framework, a comprehensive knowledge base that catalogs real-world threat actor behaviors derived from threat intelligence.
Today’s guests are our great friends at MITRE ATT&CK, Adam Pennington (Attack Lead), and Patrick Howell O’Neill, (Lead Cyber Operations Analyst). They explore how the Framework serves as a common language for communicating adversary threat behaviors and discuss its evolution from an internal project to a community-driven resource.
The latest version of the MITRE ATT&CK Framework version 14 was released on Halloween, emphasizing new features like the addition of new defensive information and techniques they previously said no to including. They discuss the decision-making process behind incorporating new techniques, such as Financial Theft, Impersonation, Phishing: Spearphishing Voice, and Phishing for Information: Spearphishing Voice.
The conversation continues on the following topics:
[5:00] MITRE ATT&CK Framework
[9:25] Improving cybersecurity detection
[13:00] New ATT&CK techniques
[16:00] Decisions about which techniques to add
[23:00] Mobile ATT&CK
[30:00] Decisions about which trends to include
[37:00] Feedback about the Framework
Resources mentioned:
What is the MITRE ATT&CK Framework?
https://attack.mitre.org/
https://medium.com/mitre-attack/attack-v14-fa473603f86b
For more information, check out our website.

Looking Behind the Curtain at the Palestinian-Aligned TA402 Nov 14, 2023

Show notes

Send us fan mail!

While the current Israeli/Palestinian conflict is on everyone’s minds, how many are thinking about the repercussions of cyber security?
Today’s guest is returning guest, Joshua Miller, Senior Threat Researcher on the APT team at Proofpoint. While he focuses on different Middle East, North African state-aligned threats, he is talking today about a Palestinian-aligned threat group coined TA402.
While there is no direct link to Hamas, their activities support the Palestinian Territories. Joshua paints a vivid picture of TA402's usual targets, strategies, and tactics, highlighting their geofencing techniques and their crafty use of compromised government agency accounts. The recent evolution of their attack chain, involving Dropbox and DLL side loading, is dissected in intricate detail, offering a glimpse into the evolving landscape of cyber threats.
This discussion not only provides insights into TA402's modus operandi but also emphasizes its distinctiveness from its previous malware campaigns.
TIMESTAMPS
[1:35] Length of time tracking TA402
[3:00] Differences between known government threat actors vs TA402
[7:00] Other groups involved in the Israeli/Palestinian War
[10:40] Normal victimology from this type of threat actor
[12:30] Comparison of tactics that TA402 is deploying
[19:20] Difficulties in tracking TA402
Resources mentioned:
Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage
New TA402 Molerats Malware Targets Governments in the Middle East
https://malpedia.caad.fkie.fraunhofer.de/actor/aridviper
https://www.proofpoint.com/us/blog/threat-insight/exploiting-covid-19-how-threat-actors-hijacked-pandemic
For more information, check out our website.

Unmasking the Tricksters: The World of Fake Browser Updates Oct 31, 2023

Show notes

Send us fan mail!

How can you tell when a website (yes, a website) is compromised? These threats are pretty crafty because they aren't out to target specific individuals; they just wait for folks like you and me to innocently click on compromised websites during our regular browsing.
But these threats don't stop at casual browsing. They sneak into emails, social media, search engines, and even web alerts. They're like chameleons, adapting to different situations.
Our guest today is Dusty Miller, a Threat Detection Analyst at Proofpoint. He identifies four key groups: SocGholish, RogueRaticate/FakeSG, ZPHP/SmartApeSG, and ClearFake. Each has its own style and tricks, but they all love using that tempting fake browser update ruse.
These threats work because they exploit our trust in websites we've visited before. Users tend to trust websites they've visited before, making them more susceptible to clicking on fake browser update prompts.
Responding to these threats isn't a walk in the park for defenders. To tackle them effectively, you need to pinpoint which specific threat you're dealing with and respond accordingly. It's like playing a game with multiple rulebooks; you've got to know which one you're up against.
TIMESTAMPS
[1:45] Fake Browser Opportunities
[5:00] Threat Actors Using Malware
[9:00] Browser Malware Clusters & Tactics
[18:00] Combating Fake Updates
[19:00] Naming New Malware
[28:00] Why These Threats
Resources mentioned:
Dr. Bob Hausmann Episode
“Are You Sure Your Browser is Up to Date?...” by Dusty Miller
For more information, check out our website.

Decoding the Malware Maze: Insights From a Threat Researcher Oct 17, 2023

Show notes

Send us fan mail!

Oh the days when spam was the only concern for email security!
Our guest today is Chris Wakelin, a Senior Threat Researcher at Proofpoint. He recounts the era when email attachments were plain text, and the concept of malicious URLs had yet to become prevalent. Chris was a pioneer in implementing email security measures and recalled introducing Spam Assassin, an early open-source program for spam detection, at his university.
Chris emphasized his belief in not shipping emails into a black hole (where emails are never seen by humans and they do not return error but instead directing them to spam folders or rejecting them at the gateway.) He stressed the importance of precision in cybersecurity, a lesson learned from his mathematical background.
TIMESTAMPS
[5:00] First Spam Filtering Implementation
[6:00] Spam Assassin
[12:15] Differences between static/dynamic detections and various signatures
[14:00] Running the Sandbox
[19:00] Naming New Malware
[23:50] Best Practices
Resources mentioned:
LCG Kit Blog
TA 558 Blog
ET Open Rule Set
For more information, check out our website.

Obfuscated: Online Threats and the Visually Impaired Oct 04, 2023

Show notes

Send us fan mail!

Billions of dollars in losses is bad enough. But when a friend loses $1,000 on a platform he trusted, online fraud gets personal.
In this podcast episode, we dive deep into the world of online fraud with the personal account of Tim Utzig, a Senior Associate Analyst at Anser and friend of his Selena Larson. Utzig, who is blind, lost $1,000 in an online scam. His story highlights the difficulties and risksof being a person with a disability in an online world that enables cyber crime and often neglects accessibility.
Timothy Kromphardt, an email fraud researcher at Proofpoint, used his expertise tracking scams and engaging directly with threat actors to help Utzif recover. He explains the complexities of cyber crime investigations and the roadblocks to bringing scammers to justice.
TIMESTAMPS
[1:00] Twitter scam story
[6:00] Viewing images with a screen reader
[8:45] Scam Busting
[12:30] Cautions to scam busting
[17:40] Unraveling the Twitter scam follow up
[20:20] Involvement of the police force & government
[26:35] Protection techniques for people with disabilities
[27:20] Key characteristics of fraud
Resources mentioned:
https://www.wired.com/story/twitter-laptop-scam-hunters/
For more information, check out our website.

DISCARDED: Live with John Hultquist! Sep 22, 2023

Show notes

Send us fan mail!

Live from New York City, it’s your Discarded podcast team at Protect 2023! Joining Selena Larson, is our special guest, John Hultquist, Chief Analyst at Mandiant, now part of Google Cloud.
They discuss various cybersecurity threats and activities of nation-states like Russia, China, and North Korea. China stands out as it hasn't executed significant destructive cyberattacks like its peers. Most of China's cyber activity involves intellectual property theft, targeting dissidents, and espionage. However, there's growing concern about their interest in critical infrastructure, particularly in times of geopolitical tension. Russia, on the other hand, has a history of destructive and disruptive attacks, such as those seen in the Middle East and South Korea.
They also discuss the role of threat intelligence and information sharing in combating cyber threats, emphasizing the importance of responsible government involvement in providing leads to the cybersecurity community.
Of course, the influence of AI in cyber threat creation is also covered, particularly in generating fake media and content.
[4:00] China sets themselves apart
[8:00] Concerns about cyber enabled kinetic impacts
[14:00] Thoughts about Russia and Ukraine
[20:00] Techniques that analysts would find helpful
[24:00] Target anticipations for 2024
Resources mentioned:
https://www.mandiant.com/resources/blog/threat-actors-generative-ai-limited
https://www.cyberwarcon.com/https://www.goodreads.com/en/book/show/41436213
https://www.reuters.com/article/us-france-election-macron-cyber-idUSKBN17Q200
https://www.helpnetsecurity.com/2015/07/08/sophisticated-successful-morpho-apt-group-is-after-corporate-data/
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
https://www.mandiant.com/resources/blog/attackers-deploy-new-ics-attack-framework-triton
https://podcast.silverado.org/episodes/how-russian-intelligence-operatives-have-attacked-ukraine-in-cyberspace-interview-with-ukrainian-security-service
For more information, check out our website.

From Rio to Madrid: Unmasking the Brazilian Banking Malware Wave Sep 05, 2023

Show notes

Send us fan mail!

Regardless of location, it’s important to understand what is happening in the global threat landscape because we are a global economy. What affects one region may affect one closer to home.
Part of the reason Brazil has become a recent hotbed is the amount of online population is expanding rapidly. Today’s guest, Jared Peck (Senior Threat Researcher at Proofpoint), dives deeper into his knowledge of this region and breaks down the unusual characteristics.
[3:30] The threat landscape in Brazil
[5:20] Brazilian banking malware being financially motivated
[9:10] Credential theft in Brazil
[13:30] Identifying threat actor clusters
[17:00] Types of Brazilian campaigns
[21:00] Diversity of malware leaders
For more information, check out our website.

Everything Comes Back in Style: How Old TTPs are Remerging in China's E-Crime Ecosystem Aug 22, 2023

Show notes

Send us fan mail!

Just like a forensic scientist, the job of a threat analyst is to search for the digital fingerprints. The key is to have a starting reference point, and then being able to see what is off from there.
Our guest today is Bryan Campbell, a Staff Threat Analyst at Proofpoint. He breaks down what is happening on the China cybercrime threat landscape, as well as, the importance of staying aware of past trends.
Join us as we also discuss:
[7:09] The Renaissance of Chinese malware in email data
[12:05] Chinese themed malware and malware families
[13:55] The campaigns delivering this type of malware
[20:00] How the China cybercrime landscape has changed
[25:04] Expectations for the future
[28:32] LLMs being used for these circumstances
For more information, check out our website.

It Works on My Machine: Why and How Engineering Skills Matter in Threat Research Aug 08, 2023

Show notes

Send us fan mail!

Engineering skills can play a massively beneficial role in cyber security, as Pim Trouerbach, a Senior Reverse Engineer at Proofpoint and Jacob Latonis, Senior Threat Research Engineer at Proofpoint, are able to share.
They emphasize the importance of understanding the requirements and context of security researchers to build effective tools. The conversation touches on the potential impact of AI and LLMs (large language models) in threat research. While AI tools can be valuable for entry-level tasks, the context, experience, and expertise of human engineers are essential for handling complex code and understanding threat actors' behaviors.
Join us as we also discuss:
[02:59] The uniqueness of engineering skills in understanding researchers' requirements for data cleaning, tool development, and working in a security environment.
[11:06] How the versioning in malware samples can provide insights into the threat actors' behavior and trajectory.
[13:24] How malware is simply software with malicious intent, and how practices of developers and threat actors can overlap.
[17:10] The tools and techniques used by threat actors, including obfuscation and encryption methods.
[21:42] The importance of context and experience in writing tools and understanding researchers' workflows.
For more information, check out our website.

An Apple a Day Won't Keep Iranian APT Away: How TA453 Targets Macs Jul 25, 2023

Show notes

Send us fan mail!

What is new with Iranian actor TA453, and what is happening with their attack chains?
To answer these questions, today’s guest is Joshua Miller, a Senior Threat Researcher on the APT team at Proofpoint. Since his last visit, Joshua has published new research on TA453, highlighting new malware and social engineering techniques, which can be found here.
Join us as we discuss the following:
[1:25] What’s new with threat actor T453
[2:35] Multi Persona Impersonation
[6:25] Use case of LNKs in the attack chain
[8:10] Use of free cloud services
[11:15] Attacking different operating systems
[16:15] Convoluted attack chains
[27:40] Collaborating with researchers, like Dropbox
For more information, check out our website.

Our TOPPODCAST Picks

Follow Us

Stay Connected

DISCARDED: Tales From the Threat Research Trenches

Related Podcasts

Links

Stay Connected