Stay ConnectedReliaQuest’s ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk’s hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week’s top cybersecurity stories.
www.reliaquest.com
Copyright: © All rights reserved
Digital Shadows CISO Rick hosts this edition of ShadowTalk. He’s joined by special guest John Kindervag, creator of Zero Trust and Senior Vice President, Cybersecurity Strategy, ON2IT Group Fellow at ON2IT Cybersecurity. They discuss: -John’s origin story and influences - what led to the creation of Zero Trust?- Zero Trust - origin, design principles, and terminology - What are your protect surfaces? - using Zero Trust- John’s new position at ON2IT***Resources from this week’s podcast***Find John Kindervag on LinkedIn: https://www.linkedin.com/in/john-kindervag-40572b1/ Find John Kindervag on Twitter: https://twitter.com/Kindervag Understanding Zero Trust Terminology: https://www.paloaltonetworks.com/resources/zero-trust Antifragile: Things That Gain from Disorder: https://www.amazon.com/Antifragile-Things-That-Disorder-Incerto/dp/0812979680
ShadowTalk hosts Stefano, Adam, Kim, and first-timer Chris bring you the latest in threat intelligence. This week they cover:-Kim takes us through the return of FIN8 - what are the updates to the “BadHatch” backdoor-Chris discusses DarkSides recent resurgence after a quiet period - what’s the latest?-Microsoft Exchange exploit update - the team discuss -How are threat actors and cybercriminals using ProxyLogon vulnerabilities?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-19-march ***Resources from this week’s podcast***FIN8: https://labs.bitdefender.com/2021/03/fin8-group-is-back-in-business-with-improved-badhatch-kit/ DarkSide: https://www.infosecurity-magazine.com/news/darkside-20-ransomware-fastest/ ProxyLogon: https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ https://www.vice.com/en/article/n7vpaz/researcher-publishes-code-to-exploit-microsoft-exchange-vulnerabilities-on-github AC Features: https://www.vice.com/en/article/pkdnkz/escape-zoom-meetings-by-faking-technical-issues-and-crying-with-this-apphttps://attack.mitre.org/techniques/T1090/003/https://attack.mitre.org/software/S0398/Mapping MITRE to Microsoft Blog: https://www.digitalshadows.com/blog-and-research/mapping-mitre-attack-to-microsoft-exchange-zero-day-exploits/Revisiting Spectre Blog: https://www.digitalshadows.com/blog-and-research/revisiting-the-spectre-and-meltdown-vulnerabilities/ Monitoring for Supplier Risks Blog: https://www.digitalshadows.com/blog-and-research/monitoring-for-risks-coming-from-suppliers/FBI IC3 Blog: https://www.digitalshadows.com/blog-and-research/fbi-ic3-2020/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Alec, Ivan, Charles, and Austin bring you the latest in threat intelligence. This week they cover:- The team discuss HAFNIUM and Microsoft Servers Exchange- Updates on the Accellion incident - what’s the latest regarding Flagstar?- The Verkada compromise - who were the victims affected by the breach of private video footage?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-12-march ***Resources from this week’s podcast***Hafnium: https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/Microsoft Exchange Compromise: https://www.ic3.gov/Media/News/2021/210310.pdfFlagstar: https://www.cyberscoop.com/flagstar-bank-accellion-breach-clop/Verkada: https://www.washingtonpost.com/technology/2021/03/10/verkada-hack-surveillance-risk/ Mapping MITRE ATT&CK To The DPRK Blog: https://www.digitalshadows.com/blog-and-research/mapping-mitre-attack-to-dprk-financial-crime-indictment/ Year In Review: COVID-19 Concerns For Cybersecurity Blog: https://www.digitalshadows.com/blog-and-research/covid-19-concerns-for-cybersecurity/ Mapping MITRE ATT&CK To The Microsoft Exchange Exploits Blog: https://www.digitalshadows.com/blog-and-research/mapping-mitre-attack-to-microsoft-exchange-zero-day-exploits/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Stefano, Adam, Dylan, and Kim bring you the latest in threat intelligence. This week they cover:- The Australian Criminal Intelligence Commission (ACIC) issues three new warrants for dealing with cybercrime - how does this new legislation increase law enforcement powers?- VMware has revealed a critical-rated bug - what should security teams know?- Adam covers ICEDID Infection and ransomware - The team discuss the DPRK IndictmentGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-05-march ***Resources from this week’s podcast***New Australian Legislature: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6623https://www.zdnet.com/article/australias-new-hacking-powers-considered-too-wide-ranging-and-coercive-by-oaic/ Vulnerability Round-Up: https://www.vmware.com/security/advisories/VMSA-2021-0002.html https://www.bleepingcomputer.com/news/security/working-windows-and-linux-spectre-exploits-found-on-virustotal/ ICEDID: https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html DPRK: https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and Law Enforcement Blog: https://www.digitalshadows.com/blog-and-research/cybercriminal-law-enforcement-crackdowns-in-2021/No Time For Threat Intel Noise Blog: https://www.digitalshadows.com/blog-and-research/no-time-for-threat-intel-noise/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Alec, Ivan, Charles, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- The team talks Initial Access Brokers (IAB) - what role do these middle- men play in the ransomware game?- How can your company mitigate risks against IABs?- The latest on the Accellion incident - Third party attacks - where does the blame fall?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-26-february ***Resources from this week’s podcast***Accellion: https://www.zdnet.com/article/fireeye-links-0-day-attacks-on-fta-servers-extortion-campaign-to-fin11-group/https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.htmlIAB Report: https://resources.digitalshadows.com/whitepapers-and-reports/initial-access-brokers-report Monitoring IABs in SearchLight: https://www.digitalshadows.com/blog-and-research/how-to-monitor-initial-access-broker-listings/ 5 Ways To Take Action Blog: https://www.digitalshadows.com/blog-and-research/5-ways-to-optimize-threat-intelligence/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Stefano, Adam, Dylan, and Kim bring you the latest in threat intelligence. This week they cover:- Adam takes us through the latest on Egregor and related arrests - is the threat group down but not out?- Dylan talks SIM-swapping - who was targeted?- Kim brings us the most recent news on the Centreon breach- Plus, the team reviews the Oldsmar water treatment facility attackGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-19-february ***Resources from this week’s podcast***Egregor operators arrested: https://www.zdnet.com/article/egregor-ransomware-operators-arrested-in-ukraine/SIM Swapping: https://www.europol.europa.eu/newsroom/news/ten-hackers-arrested-for-string-of-sim-swapping-attacks-against-celebrities https://www.youtube.com/watch?v=fHhNWAKw0bY Centreon breach: https://www.zdnet.com/article/france-russian-state-hackers-targeted-centreon-servers-in-years-long-campaign/ Oldsmar updates: https://www.mass.gov/service-details/cybersecurity-advisory-for-public-water-suppliers Threat Intel Can Be Noisy Blog: https://www.digitalshadows.com/blog-and-research/threat-intelligence-can-be-noisy-searchlight-helps/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Alec, Ivan, Austin, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- Cyberpunk and Witcher fans beware - threat actors target the CD Projekt Red source code- Ziggy ransomware calls it quits - is law enforcement activity driving this impact?- Oldsmar, FL water treatment facility gets hacked - could other critical infrastructure be at risk?- Researcher impacts dozens of tech firms through a supply chain attack, winning a $130,000 ‘bug bounty’Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-12-february ***Resources from this week’s podcast***Cyberpunk hack: https://www.theverge.com/2021/2/10/22276664/cyberpunk-witcher-hackers-auction-source-code-ransomware-attack Ziggy: https://www.bleepingcomputer.com/news/security/ziggy-ransomware-shuts-down-and-releases-victims-decryption-keys/ Oldsmar: https://www.cnn.com/2021/02/08/us/oldsmar-florida-hack-water-poison/index.html Security researcher wins award: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 Valentine’s Blog: https://www.digitalshadows.com/blog-and-research/cybercrime-and-valentines-day/ Exposed Credential Guide: https://resources.digitalshadows.com/whitepapers-and-reports/exposed-credentials-solutions-guide Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Stefano, Adam, and Kim bring you the latest in threat intelligence. This week they cover:- More threat actors and attack vectors are being investigated in the SolarWinds compromise- Law enforcement officials in the Netherlands are delivering an Emotet update that will remove it from infected devices- Kim talks Lebanese Cedar - What’s new in their latest attack?- Adam reviews Nefilim ransomware - how were they able to gain access and why it reinforces the need for securing employee accounts - Plus, don’t miss the malware name of the week! Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-05-february ***Resources from this week’s podcast***SolarWinds Update: https://www.wsj.com/articles/suspected-russian-hack-extends-far-beyond-solarwinds-software-investigators-say-11611921601 Lebanese Cedar: https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf Nefilim Ghost Credentials: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Zinc Attacks: https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/ Emotet Disruption: https://www.digitalshadows.com/blog-and-research/emotet-disruption/ DarkMarket Seizure: https://www.digitalshadows.com/blog-and-research/darkmarkets-seizure/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Alec, Charles, Austin, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- Mimecast confirms SolarWinds attackers breached security certificate the latest updates- The rise and fall of Emotet plus unique video footage of the takedown- NetWalker ransomware targeted and taken down by US and Bulgarian Law Enforcement - Avaddon adopts a new tactic - could it become the MO of other threat groups?- North Korean threat actors go phishing for security researchers with fake social media profilesGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-29-january ***Resources from this week’s podcast***Mimecast SolarWinds Update: https://www.mimecast.com/blog/important-security-update/ 23 Sunburst Targets Identified: https://www.netresec.com/?page=Blog&month=2021-01&post=Twenty-three-SUNBURST-Targets-Identified Emotet: https://www.zdnet.com/article/emotet-worlds-most-dangerous-malware-botnet-disrupted-by-international-police-operation/ Emotet Takedown Video: https://youtu.be/_BLOmClsSpc NetWalker: https://www.zdnet.com/article/us-and-bulgarian-authorities-dirsupt-netwalker-ransomware-operation/ Avaddon: https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/ NK Activity: https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-targeting-security-researchers-with-malware-0-days/ Ransomware 2020 Blog: https://www.digitalshadows.com/blog-and-research/ransomware-analyzing-the-data-from-2020/Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
ShadowTalk hosts Stefano, Adam, Kim, and Dylan bring you the latest in threat intelligence. This week they cover:- Adam and the team discuss more SolarWinds updates - what’s the latest?- Kim talks CISA security advisory - trends in recent attacks and cyber hygiene- Dylan dives into new ransomware attack on IObit - how threat actors spread the malware to its membersGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-22-january ***Resources from this week’s podcast***Cryptocurrency: https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/https://twitter.com/BleepinComputer/status/1351261442536861697 Lokibot: https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html 3 Takeaways from Forrester: https://www.digitalshadows.com/blog-and-research/top-3-takeaways-from-forrester-ti-nowtech-2020/ AzureAD: https://www.digitalshadows.com/blog-and-research/azure-ad-auto-validate-exposed-credentials/Asset and Wealth Management: https://www.digitalshadows.com/blog-and-research/threats-to-asset-and-wealth-management-in-2020-2021/ Also, don’t forget to reach out to - shadowtalk@digitalshadows.com
Our TOPPODCAST Picks 
