The Cybersecurity Defenders Podcast

Latest Episodes:

#29 - A focused discussion on ransomware with Paul Ihme, Co-Founder and Managing Principle at Soteria Security Solutions and Advisory Apr 25, 2023

Show notes

On this episode of the Cybersecurity Defenders podcast we have a focused discussion on ransomware with Paul Ihme, Co-Founder and Managing Principle at Soteria Security Solutions and Advisory.

Paul is a cybersecurity professional with experience in federal and private environments. Wide array of expertise in multiple information technology domains, specializing in penetration testing, vulnerability assessments, and security incident response.

The blog article, "Ransomware Is Irrelevant (Wait WHAT?!)" written by Adrian Sanabria that is referenced in the podcast can be viewed here.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#28 - Intel Chat: Balada injector, Lockbit, the Legion hacktool, Nokoyawa ransomware, Domino malware and more. Apr 19, 2023

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Over 1 million Wordpress sites have been infected by the Balada Injector malware
Nokoyawa ransomware attacks are being seen in the wild exploiting a Windows zero-day
An emerging Python-based credential harvester and hacktool, named Legion
A recently discovered malware family being called “Domino”
Care increasingly using the Action1 remote access software for persistence on compromised networks
A ransomware group has created encryptors targeting Macs for the first time
And a Chrome type confusion issue in the V8 Javascript engine

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#27 - Intel Chat: Apple zero-days to the end of the Genesis Market. And a dive into OT security with Dave Cullen, Field CTO of OTORIO Apr 12, 2023

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Emergency security updates issued by Apple: CVE-2023-28206 & CVE-2023-28205 .
Check Point researchers have unveiled a new sophisticated and fast acting ransomware.
eFile.com, an IRS-authorized e-file software service provider used by many for filing their tax returns, has been caught serving JavaScript malware.
The CrowdStrike Falcon OverWatch team recently observed threat actors exploit WinRAR self-extracting archives.
FBI, Europol and the Dutch Police have disrupted the infamous browser cookie market known as Genesis Market.
Microsoft’s Digital Crimes Unit along with a cybersecurity software company Fortra and Health Information Sharing and Analysis Center are taking technical and legal action to disrupt cracked, legacy copies of Cobalt Strike.

And then we dive into OT security with Dave Cullen, Field CTO for OTORIO.

As mentioned in the podcast, here is a link to the “So you want to be a SOC Analyst?” by Eric Capuano.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#26 - Intel Chat: 3CX to APT43. And a deep dive on the Capital One breach with Cloud Threat Detection Engineer, Day Johnson Apr 05, 2023

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Crowdstrike reports the 3CX supply chain attack.
Agents arrested Conor Brian Fitzpatrick on a charge of conspiracy to commit access device fraud.
SentinelOne reporting on the CatB ransomware family which is sometimes referred to as CatB99 or Baxtoy.
A new everything infostealer on the dark market called Radamanthys.
Mandiant has assessed with high confidence they identified a new APT: APT43.

And then we deep dive the Capital One data breach discovered on July 19, 2019, with DataDog Cloud Threat Detection Engineer, Day Johnson.

As mentioned in the podcast, Day's cybersecurity education-focused YouTube channel can be found here: @daycyberwox

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#25 - Hacker History: Stuxnet (Part 1) Mar 29, 2023

Show notes

This episode of the Cybersecurity Defenders podcast is the first part in a two-part mini-series about the greatest cyber attack ever conceived: Stuxnet.

Joining to help us tell the story is Kim Zetter, Journalist and Author - Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon.

Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005. Stuxnet targets supervisory control and data acquisition (SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, the worm is widely understood to be a cyberweapon built jointly by the United States and Israel in a collaborative effort known as Operation Olympic Games. The program, started during the Bush administration, was rapidly expanded within the first months of Barack Obama's presidency.

This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#24 - Intel Chat: MS Outlook exploit. And ShmooCon organizers, Heidi and Bruce Potter. Mar 22, 2023

Show notes

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

CVE-2023-23397: A zero-touch exploit that affects all versions of Windows Outlook. (Sigma rule)
CVE-2023-24880: An unpatched security bypass in Microsoft’s SmartScreen security feature.
Mandiant observes China-nexus threat actors targeting technologies that do not normally support endpoint detection and response solutions.
Kaspersky recently conducted an analysis of 155 dark web forums from January 2020 to June 2022. Threat groups are offering $240k salaries to tech jobseekers.

And an interview with Heidi and Bruce Potter, ShmooCon organizers.

ShmooCon is an annual east coast hacker convention hell-bent on offering three days of an interesting atmosphere for demonstrating technology exploitation, inventive software, and hardware solutions, and open discussions of critical infosec issues.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#23 - Intel chat with Matt Bromiley and an interview with Joe Schreiber, Co-founder & CEO of appNovi. Mar 15, 2023

Show notes

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

A new Microsoft Word Vulnerability: CVE-2023-21716.
The Emotet botnet is back spamming again.
A previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities.
A SpaceX vendor has been compromised by a LockBit affiliate.
Ring LLC, the home security and smart home company owned by Amazon, has been ransomed by ALPHV ransomware group.

And an interview with Joe Schreiber, Co-founder and CEO of appNovi.

Joe has been doing IT security since dial-up. He utilizes his knowledge and experience as a practitioner, software developer, and business developer to build highly functional, scalable, usable and quality software.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#22 - An intel chat with Matt Bromiley and an interview with Rich Heimann, Chief AI Officer at SilverSky. Mar 08, 2023

Show notes

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

Menlo Labs has uncovered an unknown threat actor that’s running an evasive threat campaign which is being distributed via Discord and is targeting government entities.
TA569 is a prolific threat actor who has been deploying website injections that run a Javascript payload known as SocGholish.
The risk to business from burned-out analysts.
The emerging post-explotation framework, EXFILTRATOR-22 or EX-22.

And an interview with Rich Heimann, Chief AI Officer at SilverSky, where we talk about Machine Learning and Artificial Intelligence as they relate to cybersecurity.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#21 - A intel chat with Matt Bromiley and an interview with Nick Gipson, Director of Cyber Operations at Pareto Cyber. Mar 01, 2023

Show notes

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel. After that, an interview with Nick Gipson, Director of Cyber Operations at Pareto Cyber.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#20 - Hacker History: WannaCry Feb 22, 2023

Show notes

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history, and with the help of Marcus Hutchins, tell the story of the WannaCry ransomware attack.

The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It propagated by using EternalBlue, an exploit developed by the United States National Security Agency (NSA) for Windows systems. EternalBlue was stolen and leaked by a group called The Shadow Brokers a month prior to the attack.

Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Cybersecurity Defenders Podcast

Related Podcasts

Links

Stay Connected