The Cybersecurity Defenders Podcast

Latest Episodes:

#218 - Coinbase + Cetus, Hazy Hawk, BadSuccesssor & DCIS takedown Jun 03, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Two significant crypto security breaches occurred in close succession this month, affecting both decentralized and centralized platforms. On May 22, Cetus—a decentralized exchange built on the Sui Network—was exploited via a vulnerability in its automated market maker (AMM). Meanwhile, Coinbase confirmed what it called a “targeted insider threat operation” that compromised data from less than 1% of its active monthly users.
A threat group identified as “Hazy Hawk” has been systematically hijacking cloud-based DNS resources tied to well-known organizations, including the US Centers for Disease Control and Prevention (CDC), since December 2023.
A newly disclosed vulnerability in Windows Server 2025, dubbed BadSuccessor, has raised major concerns among enterprise administrators managing Active Directory environments.
Federal and international law enforcement, alongside a significant number of private-sector partners, have successfully dismantled the Danabot botnet in a multiyear operation aimed at neutralizing one of the more advanced malware-as-a-service (MaaS) platforms tied to Russian cybercriminal activity.

#217 - Navigating compliance and risk with Joshua Hoffman, CRO at ControlCase May 27, 2025

Show notes

On this episode of the Cybersecurity Defenders Podcast we speak with Joshua Hoffman, CRO at ControlCase.

Josh brings a unique perspective to the cybersecurity conversation, shaped by years of building revenue strategies in fast-changing, highly regulated environments. At ControlCase, he's helping organizations navigate the growing complexity of compliance standards like CMMC, SOC, and PCI DSS, while driving adoption of tech-forward approaches to risk management. His background spans advisory roles and leadership positions across the cybersecurity ecosystem, making him a key voice on how businesses can move beyond checkbox compliance to a more strategic, scalable security posture.

#216 - Intel Chat: Scattered Spider, TA406, Oriental Gudgeon & Apple patches May 21, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A report from Google on how to defend against UNC3944, better known as Scattered Spider.
North Korea-backed threat actor TA406 has shifted its focus to targeting Ukrainian government agencies, according to new research from Proofpoint.
Since October 2024, urlscan.io has been tracking a phishing campaign known as Oriental Gudgeon, which is targeting over 40 Japanese commercial entities—mostly in the financial services sector.
Apple has released a substantial batch of security updates across its software ecosystem, including iOS 18.5, iPadOS, and the latest versions of macOS.

And the article Matt mentions about CISA shifting their alert distribution strategy: https://www.infosecurity-magazine.com/news/cisa-alert-strategy-email-social/

#215 - Inside cyber warfare, intelligence, and investment with Hank Thomas, Managing Partner and Founder at Strategic Cyber Ventures May 15, 2025

Show notes

On episode 215 of the Cybersecurity Defenders Podcast, Hank Thomas, Managing Partner and Founder at Strategic Cyber Ventures, shares his journey from Army intelligence officer to cyber-focused venture capitalist. But the most pressing part of the conversation is his call for a structural overhaul in how the US military handles cyber operations.

Thomas argues that cyber is no longer a niche; it is the starting point for modern conflict. Yet cyber capability remains fragmented across service branches, leading to inefficiencies, talent drain, and even internal competition for resources. He makes the case for a separate, fully resourced cyber force, similar to the creation of the Air Force and Space Force, to truly secure the digital domain.

He also shares concerns about government overreliance on contractors in critical cyber roles, the need for agile decision-making authority during cyber operations, and why AI must be deployed responsibly to defend a fractured critical infrastructure landscape.

#214 - Intel Chat: UTA0352/UTA0355, Commvault, Sonic wall & Bot Traffic May 14, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Since March 2025, Volexity has tracked an escalation in sophisticated phishing campaigns executed by two suspected Russian threat actors, UTA0352 and UTA0355, targeting the Microsoft 365 accounts of individuals connected to Ukraine and human rights organizations.
A recent security assessment by watchTowr uncovered a pre-authenticated Remote Code Execution (RCE) vulnerability in Commvault’s on-premise Backup and Recovery solution (Innovation Release 11.38.20).
CISA has added two SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating an escalation in exploitation activity against the vendor’s SMA series of secure remote access appliances.
Bot traffic has overtaken legitimate human use on the internet, with the latest data showing that automated traffic now accounts for 51% of all internet activity—of which 37% is classified as malicious.

#213 - Building cybersecurity products with Jonathan Haas, Product at Vanta May 08, 2025

Show notes

On this episode of the Cybersecurity Defenders Podcast we speak with Jonathan Haas, Product at Vanta, about building cybersecurity products.

Jonathan’s work focuses on making security compliance faster and more accessible, helping teams move from months-long processes to efficient workflows that take just days. Before Vanta, he was the co-founder and CEO of cybersecurity startup ThreatKey, and before that he held key roles at Snapchat, DoorDash, and Carta, where he built and refined compliance systems during times of rapid growth.

Outside of work, Jonathan explores San Francisco on foot, experiments with sourdough pizza recipes, and is cooking a dish from every country in the world. He brings a product philosophy rooted in solving real problems, blending data with user stories, and fostering inclusive teams.

You can read his blog, Haas on Saas, here.

#212 - Intel Chat: RSA 2025 May 05, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

During a talk at RSA, DHS Secretary Kristi Noem provided an update on the future direction of the Cybersecurity and Infrastructure Security Agency (CISA) under the new Trump administration.
During the panel discussion titled “AI and Cyber Defense: Protecting Critical Infrastructure” which brought together federal research leaders to talk about how AI and automation are being leveraged to address mounting cyber risks across the U.S. critical infrastructure landscape.
A new report titled The Rise of State-Sponsored Hacktivism provides a detailed analysis of how hacktivist operations have become an increasingly prominent feature of geopolitical cyber conflict.

#211 - Intel Chat: Fog, Operation Endgame, Mustang Panda & Atomic macOS Stealer (AMOS) Apr 29, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Researchers at Trend Micro have uncovered a new campaign by the Fog ransomware group, notable for its use of DOGE-themed ransom notes aimed at mocking victims rather than just extorting them.
In the wake of May 2024’s Operation Endgame, which dismantled some of the most prominent malware droppers such as IcedID, Pikabot, SystemBC, Smokeloader, and Bumblebee, law enforcement agencies across Europe and North America have moved into a new phase targeting end users of these platforms.
Zscaler researchers have recently observed Mustang Panda—also known by aliases like Bronze President, Stately Taurus, and TA416—upgrading its toolset as part of an ongoing espionage campaign, with a recent operation targeting an organization in Myanmar.
Atomic macOS Stealer (AMOS), identified as one of the most impactful macOS-targeting infostealers of 2024, leverages deceptive application installers and phishing tactics to gain access to victim machines.

#210 - The current cybersecurity landscape with Ian L. Paterson, CEO of Plurilock Apr 25, 2025

Show notes

On today’s episode of The Cybersecurity Defenders Podcast we speak with Ian L. Paterson, CEO of Plurilock, about the current state of Cybersecurity.

Ian is a data entrepreneur with more than 15 years of experience in leading and commercializing technology companies in the fields of data analytics and cybersecurity. Ian is the CEO of Plurilock, where he led the company’s growth and its successful listing on the TSX Venture Exchange.

He previously founded and served as CEO of a data monetization platform that processed over a billion data events monthly before being acquired. Ian also held the role of Director of Insights at a venture backed analytics firm, where he managed half a trillion dollars in transaction data and helped generate eight-figure analytics sales before the company’s acquisition by eBay.

Ian has raised tens of millions of dollars in financing, completed four international M&A deals, and is a co-inventor on three patents. He is an active angel investor, a frequent media commentator featured in publications like Forbes and the Wall Street Journal, and a volunteer contributor to national policy through organizations such as the Canadian Council of Innovators and the Centre for International Government Innovation.

You can listen to Ian's podcast, Code & COuntry, here: https://plurilock.com/podcast/

#209 - Intel Chat: OCC, CentreStack, UNC5174 & Oracle Apr 21, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community.

The U.S. Treasury Department’s Office of the Comptroller of the Currency (OCC) has confirmed that emails belonging to its executives and staff were compromised in a cyber incident first detected in February.
A critical zero-day vulnerability, tracked as CVE-2025-30406, has been actively exploited since March in CentreStack, a file-sharing platform developed by Gladinet and widely used by managed services providers (MSPs).
UNC5174, a state-backed Chinese threat actor, has been observed using stealthy tactics and open source tooling in recent campaigns targeting Western and Asia-Pacific organizations.
Oracle is facing sustained criticism over its handling of a recent cybersecurity incident in which a hacker claimed to have breached its systems and obtained records linked to over 140,000 tenants.

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Cybersecurity Defenders Podcast

Related Podcasts

Links

Stay Connected