Stay ConnectedReliaQuest’s ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk’s hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week’s top cybersecurity stories.
www.reliaquest.com
Copyright: © All rights reserved
ShadowTalk host Chris alongside Nicole and special guest Geoff White cover the cybercrime group Lazarus and their impact in cyber security.In this special episode, they discuss:* Geoff's new book 'The Lazarus Heist'* An overview of the Lazarus Group* How North Korea created one of the most sophisticated cyber crime groups in the world**Resources from this special podcast**Find Geoff on Twitter: https://twitter.com/geoffwhite247Find Geoff on LinkedIn: https://www.linkedin.com/in/geoffwhite247/Pre-order Geoff's book 'The Lazarus Heist' now:https://www.penguin.co.uk/books/447/447163/the-lazarus-heist/9780241554258.htmlSubscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.html Also, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
Digital Shadows CISO Rick Holland hosts this edition of ShadowTalk. Rick is joined by repeat special guest David Thejl-Clayton, Senior Advisor in Cyber Defense at Combitech. They discuss:- Rick and David's thoughts on the 2022 DBIR report (Full disclosure, they are fanboys) - Research that shows how APT groups primarily go after known vulnerabilities and not 0days- David's experience helping customers create their custom version of the DBIR***Resources from this week’s podcast***Find David on Twitter: https://twitter.com/DCSecuritydkFind David on LinkedIn: https://www.linkedin.com/in/davidclayton454/2022 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/Vocabulary for Event Recording and Information Sharing (VERIS): http://veriscommunity.net/SANS CTI Summit - VERISIZE your way into CTI: https://www.youtube.com/watch?v=AwMC6INC5TESoftware Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threats https://arxiv.org/abs/2205.07759VSec Community: https://vsec.dk/about/Checkout the “Roll your own DBIR” Templates on GitHub here: https://github.com/cvpl-fdca/rollyourown-DBIR
ShadowTalk host Chris alongside Ivan, and Nicole bring you the latest in threat intelligence. This week they cover: - Insider Threat Actor at Chinese real estate brokerage is sentenced to 7 years in prison- Microsoft Patch Tuesday mishap- NFT scamsGet this week’s intelligence summary at: https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-20-may-2022***Resources from this week’s podcast***: Vulnerability Intelligence Round-Up: The Good, The Bad and The Risky:https://www.digitalshadows.com/blog-and-research/vulnerability-intelligence-round-up-the-good-the-bad-and-the-risky/ Mustang Panda: https://www.digitalshadows.com/blog-and-research/advanced-persistent-threat-group-feature-mustang-panda/ What we’re reading this month: https://www.digitalshadows.com/blog-and-research/what-were-reading-this-month-may-2022/ Angry IT Admin Wipes Employers Databases Gets 7 Years in Prisonhttps://www.bleepingcomputer.com/news/security/angry-it-admin-wipes-employer-s-databases-gets-7-years-in-prison/Microsoft May Patch Tuesday Updates Cause Windows Ad Authentication Errorshttps://threatpost.com/microsofts-may-patch-tuesday-updates-cause-windows-ad-authentication-errors/179631/Fake Binance NFT Mystery Box Bots Steal Victims Crypto Walletshttps://www.bleepingcomputer.com/news/security/fake-binance-nft-mystery-box-bots-steal-victims-crypto-wallets/
ShadowTalk host Stefano alongside Kim bring you the latest in threat intelligence. This week they cover:* Costa Rica declares state of emergency because of Conti* The European Council formally attributes VIASAT attack to Russia* Five years since the WannaCry incident***Resources from this week’s podcast***Five Years After The WannaCry Dumpster Fire, Ransomware Remains A Global Threathttps://www.digitalshadows.com/blog-and-research/five-years-after-the-wannacry-dumpster-fire-ransomware-remains-a-global-threat/US offers $15 million reward for info on Conti ransomware ganghttps://www.bleepingcomputer.com/news/security/us-offers-15-million-reward-for-info-on-conti-ransomware-gang/Viasat shares details on KA-SAT satellite service cyberattackhttps://www.bleepingcomputer.com/news/security/viasat-shares-details-on-ka-sat-satellite-service-cyberattack/Satellite outage knocks out thousands of Enercon's wind turbineshttps://www.reuters.com/business/energy/satellite-outage-knocks-out-control-enercon-wind-turbines-2022-02-28/Viasat confirms satellite modems were wiped with AcidRain malwarehttps://www.bleepingcomputer.com/news/security/viasat-confirms-satellite-modems-were-wiped-with-acidrain-malware/Subscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Chris alongside Ivan and Nicole bring you the latest in threat intelligence. This week they cover:* REvil ransomware returns with new malware* Moshen Dragon targeting telecommunication service providers in Central Asia* Russian hackers utilize embassy emails to target governments***Resources from this week’s podcast***ALPHV: THE FIRST RUST-BASED RANSOMWAREhttps://www.digitalshadows.com/blog-and-research/alphv-the-first-rust-based-ransomware/Colonial Pipeline One Year Later: What’s Changed?https://www.digitalshadows.com/blog-and-research/colonial-pipeline-one-year-later-whats-changed/REvil ransomware returns: New malware sample confirms gang is backhttps://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/Chinese cyber-espionage group Moshen Dragon targets Asian telcoshttps://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-moshen-dragon-targets-asian-telcos/Russian hackers compromise embassy emails to target governmentshttps://www.bleepingcomputer.com/news/security/russian-hackers-compromise-embassy-emails-to-target-governments/Subscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Stefano alongside Xue, Kim, & Rory bring you the latest in threat intelligence. This week they cover:* Cybercrime group Lapsus$ is back* Cyber activity in the Russia-Ukraine war so far***Resources from this week’s podcast***The Russia – Ukraine War: Two Months Inhttps://www.digitalshadows.com/blog-and-research/the-russia-ukraine-war-two-months-in/Opportunity In The Midst Of Chaos: Russian-Speaking Cybercriminals Grapple With Sanctions And Forum Takedownshttps://www.digitalshadows.com/blog-and-research/russian-speaking-cybercriminals-grapple-with-sanctions-and-forum-takedowns/Leaked Chats Show LAPSUS$ Stole T-Mobile Source Codehttps://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/Subscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Chris alongside Ivan, Rick, and Nicole bring you the latest in threat intelligence. This week they cover:* Security researchers find connection between Conti and Karakurt* Chernovite’s Pipedream malware targets ICS networks* Lazarus hacking group is targeting organizations in the cryptocurrency and blockchain industries***Resources from this week’s podcast***The Power Of Data Analysis In Threat Intelligence – Part 2: Machine Learninghttps://www.digitalshadows.com/blog-and-research/the-power-of-data-analysis-in-threat-intelligence-part-2-machine-learning//What We’re Reading This Month: April 2022https://www.digitalshadows.com/blog-and-research/what-were-reading-this-month-april-2022/The Role Of Non-Fungible Tokens (NFTs) In Facilitating Cybercrimehttps://www.digitalshadows.com/blog-and-research/the-role-of-non-fungible-tokens-in-facilitating-cybercrime/Karakurt revealed as data extortion arm of Conti cybercrime syndicatehttps://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/Dragos estimates that Chernovite’s Pipedream malware targets ICS networkshttps://industrialcyber.co/threats-attacks/dragos-estimates-that-chernovites-pipedream-malware-targets-ics-networks/US warns of Lazarus hackers using malicious cryptocurrency appshttps://www.bleepingcomputer.com/news/security/us-warns-of-lazarus-hackers-using-malicious-cryptocurrency-apps/Subscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Stefano alongside Rory bring you the latest in threat intelligence. This week they cover:* 'RaidForums' has been shut down and seized* SandWorm targets electrical substations in Ukraine* The resurgence of hacktivism in the Russia-Ukraine conflict***Resources from this week’s podcast***Q1 2022 Vulnerability Rounduphttps://www.digitalshadows.com/blog-and-research/q1-2022-vulnerability-roundup/Q1 2022 Ransomware Rounduphttps://www.digitalshadows.com/blog-and-research/q1-2022-ransomware-roundup/One of the world’s biggest hacker forums taken downhttps://www.europol.europa.eu/media-press/newsroom/news/one-of-world%E2%80%99s-biggest-hacker-forums-taken-downSubscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Chris alongside Ivan and Austin bring you the latest in threat intelligence. This week they cover:* Spring4Shell: The Internet security disaster that wasn’t* New Borat remote access malware is no laughing matter* FIN7 hackers evolve toolset, work with multiple ransomware gangs***Resources from this week’s podcast***Intelligence Collection Plans: Preparation Breeds Successhttps://www.digitalshadows.com/blog-and-research/intelligence-collection-plans-preparation-breeds-success/Team A Vs Team B: What Is Motivating Lapsus$?https://www.digitalshadows.com/blog-and-research/team-a-vs-team-b-what-is-motivating-lapsus/Five Things We Learned From The Conti Chat Logshttps://www.digitalshadows.com/blog-and-research/five-things-we-learned-from-the-conti-chat-logs/Explaining Spring4Shell: The Internet security disaster that wasn’thttps://arstechnica.com/information-technology/2022/04/explaining-spring4shell-the-internet-security-disaster-that-wasnt/New Borat remote access malware is no laughing matterhttps://www.bleepingcomputer.com/news/security/new-borat-remote-access-malware-is-no-laughing-matter/FIN7 hackers evolve toolset, work with multiple ransomware gangshttps://www.bleepingcomputer.com/news/security/fin7-hackers-evolve-toolset-work-with-multiple-ransomware-gangs/Subscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.htmlAlso, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
ShadowTalk host Stefano alongside Chris and Rick bring you the latest on structured analytical techniques. This episode they cover: *Why they use SATs in their intel team*How they came up with the idea to analyze Lapsus$*How they chose Team A/Team B and how they prepared it*How the exercise performed*Future research direction***Resources from this special podcast***Meet Lapsus$: An Unusual Group In The Cyber Extortion Business https://www.digitalshadows.com/blog-and-research/meet-lapsus-an-unusual-group-in-the-cyber-extortion-business/The Okta Breach: What We Know So Farhttps://www.digitalshadows.com/blog-and-research/the-okta-breach-what-we-know-so-far/A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis https://www.stat.berkeley.edu/~aldous/157/Papers/Tradecraft%20Primer-apr09.pdfSubscribe to our threat intelligence email: https://info.digitalshadows.com/SubscribetoEmail-Podcast_Reg.html Also, don’t forget to reach out to - shadowtalk@digitalshadows.com - if you have any questions, comments, or suggestions for the next episodes.
Our TOPPODCAST Picks 
