The Cybersecurity Defenders Podcast

Latest Episodes:

#228 - Defender Fridays: Building detection and response processes that scale with Ryan Cox, Senior Security Engineer at Revinate Jul 11, 2025

Show notes

Join us every Friday as we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

Each week, we bring you a different expert guest who will share their invaluable insights on topics ranging from threat hunting and incident response to security operations and detection engineering. What makes these sessions special is their informal and interactive nature, allowing for an engaging dialogue between our guests, hosts, and the audience.

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#227 - Intel Chat: Sudo, browser vulns, Medusa & Cloudflare blocks AI Jul 08, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Two critical local privilege escalation vulnerabilities in the Sudo utility—CVE-2025-32462 and CVE-2025-32463—have been disclosed by the Stratascale Cyber Research Unit.
Google Chrome and Mozilla Firefox are both facing distinct, serious threats this week—Chrome from a zero-day vulnerability under active exploitation and Firefox from a campaign of malicious browser extensions targeting cryptocurrency users.
The Medusa ransomware group, active since late 2021, has maintained a consistent and aggressive operational tempo into 2025.
Cloudflare has rolled out a significant change to how websites handle AI crawlers, positioning itself as the first internet infrastructure provider to block AI-driven scraping by default.

#226 - Intel Chat: Thai takedown, Salt Typhoon, Iran & BlueNoroff Jul 01, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Thai police conducted a major raid on the Antai Holiday Hotel in central Pattaya late on Monday night, June 16th, uncovering a joint operation involving both ransomware distribution and illegal gambling.
Canada’s national cybersecurity agency has confirmed that a Chinese state-sponsored group known as Salt Typhoon successfully targeted a Canadian telecommunications company earlier this year, exploiting a Cisco vulnerability.
The Department of Homeland Security (DHS) has issued a National Terrorism Advisory System bulletin warning of an elevated risk of cyberattacks and potentially violent extremism in response to escalating geopolitical tensions between the U.S. and Iran.
Security researchers have confirmed that recent social engineering campaigns exploiting Zoom are the work of BlueNoroff, a North Korean state-sponsored APT group known for targeting financial entities, particularly in the cryptocurrency and online gambling sectors.

#225 - Defender Fridays: EDR, DFIR & endpoint triage with Brian Carrier, CEO of Sleauth Kit Labs Jun 27, 2025

Show notes

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#224 - Intel Chat: OtterCookie, Flodrix, Water Curse & Scattered Spider Jun 24, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A new malware strain known as OtterCookie, developed by the North Korean APT group Lazarus, has been dissected in a detailed technical analysis by offensive security expert Mauro Eldritch.
Attackers are currently exploiting a critical vulnerability in the Langflow platform — an open-source Python-based web app used to build AI workflows and agents — to deliver a new botnet called Flodrix.
A new campaign from an emerging threat group named Water Curse is targeting the software supply chain by leveraging GitHub repositories that masquerade as legitimate security tools.
The threat actor known as Scattered Spider, also tracked as UNC3944 by Google and Mandiant, has apparently shifted its operational focus from the retail sector to the US insurance industry, according to a new alert from Google’s Threat Intelligence Group.

#223 - Defender Fridays: Maintaining the human touch in security operations with Hayden Covington, SOC SecOps Lead at BHIS Jun 20, 2025

Show notes

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#222 - Intel Chat: PurpleHaze, KEV++, ChatGPT & Mirai botnet Jun 18, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Over an eight-month period beginning in July of last year, China-backed threat actors carried out a coordinated campaign that included attempts to breach cybersecurity vendor SentinelOne.
CISA has added two newly confirmed exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active abuse in the wild.
OpenAI has banned ChatGPT accounts linked to state-sponsored threat actors, including groups affiliated with governments in China, Russia, North Korea, Iran, and others.
A critical vulnerability in Wazuh Server, CVE-2025-24016 (CVSS 9.9), is being actively exploited by threat actors to deliver multiple Mirai botnet variants for distributed denial-of-service (DDoS) operations.

#221 - AI and Automation for security operations with Filip Stojkovski, Staff Security Engineer at Snyk Jun 17, 2025

Show notes

On this episode of the Cybersecurity Defenders Podcast we speak with Filip Stojkovski, Staff Security Engineer at Snyk.

Filip is a cybersecurity professional with over 15 years of experience. He began his career as a SOC analyst and now leads SecOps engineering at Snyk. Filip also advises organizations on SOAR, AI for SOC, and threat intelligence strategies. He holds multiple SANS certifications, including GSTRT, GCTI, and GCFA, and was recognized as “Threat Seeker of the Year.” He is the creator of the LEAD Threat Intelligence Framework and the Security Automation Development Life Cycle.

Filip regularly shares his expertise through industry talks and on his blog: Cyber Security Automation and Orchestration

#220 - Defender Fridays: AI on the edge with David (DWIZZLE) Weston, Corporate Vice President, Enterprise and OS Security at Microsoft Jun 13, 2025

Show notes

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#219 - Intel Chat: MSFT-Crowdstrike, GangExposed, Fastlane & HashiCorp Nomad servers Jun 11, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Microsoft and CrowdStrike have announced a strategic alliance aimed at deconflicting threat actor names across their platforms.
A new, anonymous figure calling himself GangExposed has surfaced in the cyber threat landscape, publishing a significant set of internal documents that reveal the identities of top leadership within the Conti and Trickbot ransomware crews.
A new supply chain attack targeting the Ruby ecosystem has emerged, leveraging impersonated packages to exfiltrate sensitive data from Telegram communications.
Researchers at Wiz have published what appears to be the first confirmed case of active exploitation of misconfigured HashiCorp Nomad servers in the wild, used by attackers to mine Monero cryptocurrency.

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Cybersecurity Defenders Podcast

Related Podcasts

Links

Stay Connected