DISCARDED: Tales From the Threat Research Trenches

Latest Episodes:

Threats and Risks in the Global South Jul 11, 2023

Show notes

When researching cyber threats, there is a bias towards to the West and most of Europe. But what about the global majority?
Today’s guest is Martijn Grooten, a Digital Security Threat Analyst with Internews. With 16 years of experience in cybersecurity, he has recently focused on the impact of security for at risk groups and people.
Join us as we discuss the following:

Outdated ideas of security for the general public
Common trends geographically
The distinction of threats between devices

For more information, check out our website.
Resources:
Martijn’s BotConf talk: https://youtu.be/CcqOy6WdUjw
Martijn on social media: Twitter, Mastodon, LinkedIn

Weird & Wacky Researcher Summer: The Artifacts & Detections Edition Jun 27, 2023

Show notes

Send us fan mail!

It's shaping up to be a weird and wacky summer for threat researchers.
While it’s been quieter on the front end, there are still many stories to share with some weird and wacky incidents. This episode also includes a fun, dramatized read of an email tactic.
Join us as we discuss the following:

Where the team identifies on the Cyber Alignment Chart
Use of celebrity names within email lures
Recent PDF antics
Updates about activity from current threat actors

For more information, check out our website!

It's Summertime: What’s the E-crime Vibe? Jun 14, 2023

Show notes

Send us fan mail!

Who’s quiet and who’s making noise? What’s the backchannel chatter over at Proofpoint?
Proofpoint threat researchers Joe Wise and Pim Trouerbach join this week’s episode to discuss the e-crime vibe for the first half of 2023.
Join us as we discuss the following:

Emotet’s activity, or lack thereof
Chaotic vibes from IcedID
TA570 and TA577 setting trends

When the Threat Profile is High: Protecting At-Risk Individuals Online May 30, 2023

Show notes

Send us fan mail!

How does cybercrime threaten individual reporters? What about an entire newsroom?
What if you’re an average person who suddenly becomes the center of a dark conspiracy theory?
Welcome to the world of cybersecurity for at-risk individuals. In this episode, renowned cybersecurity expert, Runa Sandvik joins to talk about her work protecting journalists and newsrooms from powerful attackers.
Join us as we discuss the following:

Protecting personal and corporate devices and accounts for high risk individuals
Common security gaps found in highly targeted organizations
Effectively using cybersecurity tools
Communicating cybersecurity guidance in the workplace

Resources:

The Spies and Stalkers of Surveillance Capitalism May 16, 2023

Show notes

Send us fan mail!

A brief note on content for today's episode, we are going to be discussing or mentioning stalking, domestic abuse, and sex trafficking in today's show.
If you’re a threat actor with a million dollar budget targeting high ranked targets like dissidents, activists, journalists and politicians, how do you do it? What if you’d like to stalk your neighbor, or your ex?
In this episode, Proofpoint security research engineer, Chris Talib discusses high-ticket mobile spyware, the proliferation of low-cost stalkerware, surveillance capitalism and why he believes technology can’t solve social problems.
Join us as we discuss the following:

Mobile spyware tools
The impact of low cost stalkerware
Moral and ethical implications of developing spyware
The role of governments,organizations and activists in protecting citizen’s right to privacy

Resources:

Beyond Banking: IcedID Gets Forked May 02, 2023

Show notes

Send us fan mail!

At least three threat actors are ushering in a new era for IcedID, originally classified as banking malware in 2017. In this episode, Proofpoint researchers, Joe Wise and Pim Trouerbach, are here to share their research on the Lite and Forked IcedID variants
Join us as we discuss the following:

Lite IcedID Variant
Forked IcedID Variant
The key differences between the variants
Which operators the Proofpoint team hypothesizes are behind the attacks

Resources:
https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid

“Did I miss you in Orlando?”: The Rise of SMS Phishing Apr 18, 2023

Show notes

Send us fan mail!

In this podcast episode, Proofpoint senior threat researcher, Adam McNeil, joins us to talk about conversational SMS phishing. These campaigns target mobile devices and often start with a simple, innocuous question.
“Are you coming to dinner tomorrow?” can lead to anything from fraud to impersonation to financial schemes and is considered a $3 billion threat.
In this episode, we discuss the following:

Why a threat actor would choose a conversational SMS campaign
Different scams associated with conversational SMS phishing
Lack of awareness surrounding mobile threats

Staying Ahead of Cloud-Based Threats: Insights on today's threat landscape Apr 07, 2023

Show notes

Send us fan mail!

Cloud threats are a growing concern due to users' and organizations' increasing adoption of cloud computing. It's crucial to develop the skills needed to identify and analyze cloud-based threats and know the latest security tools and techniques to detect, prevent, and respond to cloud-based attacks.
Ultimately, security researchers and analysts play a critical role in helping organizations mitigate cloud-related risks and ensure the security of their cloud environments. In this episode, Eilon Bendet, from the Proofpoint cloud threat research team, joins us to discuss the cloud threats he is seeing.
In this episode, we discuss the following:

Cloud threat Detection and landscape
Main objectives for threat actors when they leverage the cloud
How users and organization can best protect themselves

Additional Resources:
Cloud Threats & Cloud Threat Landscape

https://www.proofpoint.com/us/threat-reference/casb

https://www.proofpoint.com/us/corporate-blog/post/dont-let-cloud-threats-rain-your-parade

https://www.proofpoint.com/us/corporate-blog/post/microsoft-office-365-attacks-circumvent-multi-factor-authentication-lead-account

https://www.proofpoint.com/us/blog/cloud-security/proofpoint-discovers-potentially-dangerous-microsoft-office-365-functionality

https://www.proofpoint.com/us/blog/cloud-security/proofpoint-analyzes-potentially-dangerous-functionality-microsoft-sway-enables

https://www.proofpoint.com/us/resources/webinars/deep-dive-latest-cloud-threats-microsoft-environments

Cat-phishing Dogfighters Mar 21, 2023

Show notes

Send us fan mail!

In the cyber threat intelligence and cybersecurity world, there is a growing recognition of the value of professionals with diverse backgrounds and skillsets. While many individuals in the field come from traditional computer science or engineering backgrounds, there is also a trend of people entering the field from unexpected paths. Sarah Sabotka, Senior Threat Researcher at Proofpoint, joins us on this episode to discuss her background in animal cruelty investigations.
In this episode, we discuss the following:

What a typical day in the life of an animal cruelty investigator looks like
How Sarah used social engineering and open-source intelligence (OSINT) to build cases
How non-traditional skills and experiences have translated to success in infosec

Resources:

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Prank or Propaganda? TA499 Pesters Politics Mar 07, 2023

Show notes

Send us fan mail!

In this episode, Zydeca Cass, Senior Threat Researcher at Proofpoint, joins the show to discuss Russia-aligned threat actor TA499. Zydeca dives into what makes tracking this threat actor so unique.
Join us as we discuss:

Who TA499 are and what they do
What makes their activity a cyber threat others should pay attention to
What their activity tells us about Russia-aligned groups
How to prevent being exploited

Check out these resources we mentioned:

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!