Stay ConnectedReliaQuest’s ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk’s hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week’s top cybersecurity stories.
www.reliaquest.com
Copyright: © All rights reserved
ShadowTalk hosts Alec, Charles, Austin, and Ivan bring you the latest in threat intelligence. This week they cover:- Significant updates to the SolarWinds incident- Overlaps of the "Sunburst" backdoor and malware known to be used by the believed Russia-affiliated APT "Turla"- Possible SolarWinds scam - SolarLeaks claiming to sell data stolen in SolarWinds attacks- The newly identified Sunspot malware- Mimecast reporting of a compromised certificate possibly related to SolarWinds - the team dives deeper- DarkSide ransomware decryptor keys being released and how DarkSide respondedGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-15-january ***Resources from this week’s podcast***Sunburst: https://securelist.com/sunburst-backdoor-kazuar/99981/SolarLeaks: https://www.bleepingcomputer.com/news/security/solarleaks-site-claims-to-sell-data-stolen-in-solarwinds-attacks/SolarWinds updates: https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/ https://www.cyberscoop.com/mimecast-email-breach-solarwinds-russia/?category_news=technology Sunspot: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/Covid-19 threat landscape updates: https://www.digitalshadows.com/blog-and-research/targets-and-predictions-for-the-covid-19-threat-landscape/Dark Web Marketplaces And Cybercriminal Forums: https://www.digitalshadows.com/blog-and-research/tracing-dark-web-marketplaces-and-cybercriminal-forums/ ShadowTalk Email: shadowtalk@digitalshadows.com
ShadowTalk hosts Stefano, Kim, Adam, and Dylan bring you the latest in threat intelligence. This week they cover:- Post-holiday updates on SolarWinds - what have we missed? - Ticketmaster gets fined $10 million for illegally accessing the internal systems of a competitor, using the credentials of a former employee- Apex Laboratory announced that it was the victim of a cyber attack - what we know so far- 2020 in review: What will the new year bring in the world of cyber security?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-08-january ***Resources from this week’s podcast***SolarWinds:https://www.solarwinds.com/securityadvisorySolarWinds Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-what-security-teams-need-to-know/ SolarWinds Update Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-update/ TicketMaster Fraud: https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0APT27: https://www.scmagazine.com/home/security-news/ransomware/chinese-espionage-group-apt27-moves-into-ransomware/ 2020 Lookback Blog: https://www.digitalshadows.com/blog-and-research/lookingback-at-2020/ 2021 Forecasts Blog: https://www.digitalshadows.com/blog-and-research/2021-forecasts/ ShadowTalk Email: shadowtalk@digitalshadows.com
ShadowTalk hosts Kacey, Charles, Alec, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover all things SolarWinds:- An overview of the campaign and event timelines- SolarWinds' SEC filing and its implications- Early indicators of compromise, including public FTP creds and an access listing- What we can expect from this attack as time goes onGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-18-december ***Resources from this week’s podcast***Microsoft: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/SolarWinds:https://www.solarwinds.com/securityadvisoryFireEye: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.htmlDomainTools: https://www.domaintools.com/resources/blog/unraveling-network-infrastructure-linked-to-the-solarwinds-hack?utm_source=Social&utm_medium=twitter&utm_campaign=SUNBURST#FTP Creds (2019):https://savebreach.com/solarwinds-credentials-exposure-led-to-us-government-fireye-breach/ SEC Filinghttps://portal.pannus.uk/client/intelligence/incident/67083793 https://www.sec.gov/ix?doc=/Archives/edgar/data/1739942/000162828020017451/swi-20201214.htm Dark Halo: https://portal.pannus.uk/client/intelligence/incident/67128769https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/SolarWinds Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-what-security-teams-need-to-know/
ShadowTalk hosts Stefano, Kim, and Adam bring you the latest in threat intelligence. This week they cover:- FireEye, a top security firm, suffers a breach caused by a state-sponsored attacker- Phishing campaigns target the distribution of the Covid-19 vaccine- Ransomware gangs resort to cold-calling victims in order to cash in - Plus, the very festive ‘Malware name of the week’Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-11-december ***Resources from this week’s podcast***FireEye breach: https://arstechnica.com/information-technology/2020/12/security-firm-fireeye-says-nation-state-hackers-stole-potent-attack-tools/ FireEye breach: https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html Phishing targeting the vaccine: https://portal-digitalshadows.com/search/intelligenceincident/66425527 Phishing targeting the vaccine: https://securityintelligence.com/posts/ibm-uncovers-global-phishing-covid-19-vaccine-cold-chain/ Ransomware cold calls: https://www.zdnet.com/article/ransomware-gangs-are-now-cold-calling-victims-if-they-restore-from-backups-without-payingMalware name of the week: https://www.pcrisk.com/removal-guides/10819-merry-christmas-ransomware Egregor blog: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/Holiday Cybercrime blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/ Podcast email: shadowtalk@digitalshadows.com
ShadowTalk hosts Kacey, Charles, and Digital Shadows CISO Rick chat with Brian Wrozek of Optiv. They cover: - Brian’s origin in cybersecurity - Looking forward to 2021 - what should we be focusing on and what do we need to be prepared for?- Threat modeling and tabletop exercises - how do we prepare for the worst?- Brian and the team talk degrees - how big of a role do they play when recruiting? ***Resources from this week’s podcast***Find Brian Wrozek on LinkedIn: https://www.linkedin.com/in/brianwrozek Find Brian Wrozek on Twitter: https://twitter.com/bdwtexas?lang=en University of Dallas link: https://udallas.edu/cob/about/adjunct-faculty/wrozek-brian.phpOptiv: https://www.optiv.com/
ShadowTalk hosts Kacey, Charles, Alec, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- REvil ransomware breathes new life into Gootkit malware - C-level email credentials listed for sale on a cybercriminal marketplace- Does REvil have ties to Maze and Egregor? A conversation about source evaluation and attribution.- Spam Haus reports that thousands of IPV4 addresses are suddenly coming alive - is more BGP abuse on the horizon?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-4-december ***Resources from this week’s podcast***Gootkit: https://www.bleepingcomputer.com/news/security/gootkit-malware-returns-to-life-alongside-revil-ransomware/Threat actor sells accounts: https://www.zdnet.com/article/a-hacker-is-selling-access-to-the-email-accounts-of-hundreds-of-c-level-executives/REvil: https://twitter.com/campuscodi/status/1333462999105998848Spam Haus: https://www.reddit.com/r/blueteamsec/comments/k42sk7/suspicious_network_resurrections_spamhouse/?utm_source=share&utm_medium=web2x&context=32021 Predictions blog: https://www.digitalshadows.com/blog-and-research/2021-forecasts/2021 Predictions webinar: https://info.digitalshadows.com/2020Dec09-Live-Webinar-Predictions.htmlEgregor blog: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/
ShadowTalk hosts Stefano, Adam and Dylan bring you the latest in threat intelligence. This week they cover: - QBot drops Prolock for Egregor ransomware- IoT new regulations - Black Friday threats and opportunities- Plus: The team discuss the malware name of the weekGet this week’s intelligence summary at: https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-27-november***Resources from this week’s podcast***Holiday Cybercrime Blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/Egregor: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/
ShadowTalk hosts Kacey, Alec, and Charles, bring you the latest in threat intelligence. This week they cover: - New Chinese APT group, FunnyDream, conducts a sophisticated cyber espionage campaign targeting SE Asian government entities.- Ransomware operators want to be heard - Ragnar Locker turns to Facebook and Egregor begins printing ransom notes.- Is Egregor the new Maze? Let's unpack this.- Plus, the team talks about their favorite Thanksgiving dish, plus a side of footballGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-20-november ***Resources from this week’s podcast***FunnyDream: https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdfRagnar Locker: https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/Egregor: https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/Darkside Blog: https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/Triangle InfoSecCons - Cybercrime Trends with Digital Shadows CISO Rick: https://www.youtube.com/watch?v=owBgVgiWFXMRansomware Trends in Q3 Webinar: https://resources.digitalshadows.com/webinars/ransomware-trends-in-q3Holiday Cybercrime Blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/Digital Shadows in Security Mag: https://www.securitymagazine.com/articles/93950-cybercriminal-forum-offers-wisconsin-voter-data-for-free
ShadowTalk hosts Stefano, Kim, Dylan, and Adam bring you the latest in threat intelligence. This week they cover: - RegretLocker’s approach to quickly encrypting files - how their efficiency compares to counterpart Ryuk - Vx Underground’s code used in ransomware attacks- APT32, or OceanLotus, using social media and news sites to draw in users and redirect them to phishing pages - U.S. DoJ seizes $24 Million in cryptocurrency, assisting the Brazilian governmentGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-13-november ***Resources from this week’s podcast***RegretLocker Ransomware: https://www.bleepingcomputer.com/news/security/new-regretlocker-ransomware-targets-windows-virtual-machines/Vx Underground: https://twitter.com/smelly__vx/status/1323849544145211392https://twitter.com/vxunderground/status/1326055110292729856OceanLotus: https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/U.S. Seizes Virtual Currency: https://www.justice.gov/opa/pr/us-seizes-virtual-currencies-valued-24-million-assisting-brazil-major-internet-fraud)https://www.cyberscoop.com/silk-road-bitcoin-billion-wallet/Bitcoin vs. Monero Blog: https://www.digitalshadows.com/blog-and-research/bitcoin-vs-monero/ Evolution of DDoS: https://www.digitalshadows.com/blog-and-research/the-evolution-of-ddos-activity-in-2020
ShadowTalk hosts Kacey, Alec, Charles and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- Election update - Because that’s what’s on many people’s minds right now- North Korean Group Kimsuky Targets Government Agencies With New Malware - Maze Group announces closing of its operations- Wroba mobile malware targets US smartphones - Plus: Group discusses Guy FawkesGet this week’s intelligence summary at: https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-06-november-2020***Resources from this week’s podcast***Clickbait to Checkmate: https://www.digitalshadows.com/blog-and-research/sms-based-scam-targets-us-smartphones-and-accesses-victim-locations/Glossary: https://www.digitalshadows.com/blog-and-research/a-glossary-of-cybercriminal-access-offerings/Phillip Wylie Podcast: https://resources.digitalshadows.com/threat-intelligence-podcast-shadowtalk/special-guest-phillip-wylie-talks-origin-story-bear-wrestling-and-much-more
Our TOPPODCAST Picks 
