The Cybersecurity Defenders Podcast

Latest Episodes:

#268 - Intel Chat: LLM integration in malware, Android spyware family LandFall, Windows kernel zero-day flaw & Ex-L3Harris executive sells trade secrets Nov 17, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Google’s Threat Intelligence Group has observed a significant shift in 2025, threat actors are no longer using AI to just speed up operations, they are now integrating LLMs directly into the malware.
Unit 42 has identified a previously undocumented Android spyware family, named LandFall, discovered during an investigation into iOS exploit chains involving malicious DNG images.
Microsoft’s November Patch Tuesday rollout includes fixes for over 60 vulnerabilities, one of which is a zero-day privilege escalation flaw in the Windows kernel that has already been exploited in the wild.
Former executive at L3Harris Trenchant, Peter Williams, has pleaded guilty in U.S. federal court to selling 8 trade secrets valued at over 1.3 million to a Russian-based software broker involved in the zero-day exploit market.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at limacharlie.io.

#267 - Defender Fridays: AI in SecOps - what's real vs. what's hype? With Alec Fenton from Foresite Cybersecurity Nov 14, 2025

Show notes

In this episode of Defender Fridays, we talk to Alec Fenton, VP Security Operations at Foresite Cybersecurity, practical career advice for defenders, SOC metrics that actually matter and AI in security operations.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Alec is a seasoned Cyber Security professional with over 15 years of extensive experience across many IT domains. With a career spanning more than a decade, Alec has honed his expertise in addressing a broad spectrum of cybersecurity challenges, leveraging his analytical prowess and hands-on approach to leadership.

Throughout his career, Alec has navigated the intricate landscape of IT security, working across various sectors including managed service providers and private companies. His tenure as an analyst in the cybersecurity space has not only equipped him with a deep understanding of emerging threats and vulnerabilities but has also shaped his leadership philosophy of "lead from the front."

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#266 - Preparing for Out-of-Band Communication in Incident Response with Navroop Mitter from ArmorText Nov 12, 2025

Show notes

On this episode of The Cybersecurity Defenders Podcast we speak with Navroop Mitter, CEO of ArmorText, about the role of Out-of-Band (OOB) communication in cyber incident response.

ArmorText Named a Leader in The Forrester Wave™: Secure Communications Solutions, Q3 2024

Cyber Resilience: Incident Response Tabletop Exercises

Navroop Mitter is the CEO of ArmorText, a mobile security and privacy company based in the Washington, D.C. area.

Before founding ArmorText, Navroop was a Senior Manager in Accenture’s North American Security Practice, where he built and led information security programs across multiple regions. He helped double Accenture’s Scandinavian security practice within a year and established the firm’s first near-shore security delivery center in Argentina, hiring and training over 30 practitioners in under 30 days.

Navroop has led large-scale international security engagements, working across cultures and time zones to strengthen teams in the U.S., India, and abroad. Recognized for his entrepreneurial mindset and expertise in identity and access management, he became one of Accenture’s most sought-after leaders for complex, multi-country security initiatives.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#265 - Intel Chat: AWS TruffleNet exploit, React Native vulnerability, SesameOp OpenAI Assistants API C2 channel & Operation SkyCloak Nov 10, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A newly observed threat campaign is exploiting Amazon Web Services' Simple Email Service using stolen credentials and open source tools to perform cloud reconnaissance and eventually launch Business Email Compromise scams.
A critical vulnerability has been disclosed in the React Native Community CLI NPM package, a toolset widely used for building React Native applications.
Microsoft's Detection and Response Team (DART) has discovered a novel backdoor, SesameOp, that uses the OpenAI Assistants API as a command-and-control (C2) channel, highlighting a new way attackers are misusing generative AI platforms.
Researchers from Cyble and Seqrite Labs have disclosed a sophisticated malware campaign, dubbed Operation SkyCloak, targeting defense-related organizations in Russia and Belarus through weaponized attachments delivered via phishing emails.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#264 - Defender Fridays: Dive into SaaS Intrusion Trends with Julie Agnes Sparks from Datadog Nov 07, 2025

Show notes

In this episode of Defender Fridays, LimaCharlie Founder Maxime Lamothe-Brassard talks to Julie Agnes Sparks, Security Engineer at Datadog, about how to maximize logging visibility for effective detection engineering.

Julie has a passion for continuous learning, proactively detecting significant security events, and responding effectively. Interests include: diversity & inclusion, privacy, and making technology more accessible.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#263 - Intel Chat: BlackBasta, BlueNoroff, Operation ForumTroll & Aisuru Nov 03, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

The UK Information Commissioner's Office (ICO) recently released a comprehensive 136-page report detailing the BlackBasta ransomware attack on Capita in March 2023.
Kaspersky researchers have detailed two active campaigns from North Korean APT group BlueNoroff, which continue the group’s long-running SnatchCrypto operation targeting individuals in financial and tech sectors.
The exploitation of the first Chrome zero-day of 2025 has been attributed to a state-sponsored threat actor involved in Operation ForumTroll, a cyber-espionage campaign targeting Russian entities across sectors like education, finance, media, and government.
Netscout has identified a newly emerging Internet of Things (IoT) botnet, Aisuru, which has already launched distributed denial-of-service (DDoS) attacks exceeding 20 Tbps, placing it among the most powerful botnets observed to date.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#262 - Defender Fridays: What does "AI-ready SOC" actually mean? With Dr. Anton Chuvakin from CISO, Google Cloud Oct 31, 2025

Show notes

Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud and a recognized expert in SIEM, log management, and PCI DSS compliance, will help us cut through the buzzwords and discuss modern security operations.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Dr. Chuvakin is now involved with security solution strategy at Google Cloud, where he arrived via Chronicle Security (an Alphabet company) acquisition in July 2019. He is also a co-host of Cloud Security Podcast.

Until June 2019, Dr. Anton Chuvakin was a Research VP and Distinguished Analyst at Gartner for Technical Professionals (GTP) Security and Risk Management Strategies (SRMS) team. At Gartner he covered a broad range of security operations and detection and response topics, and is credited with inventing the term "EDR."

He is a recognized security expert in the field of SIEM, log management and PCI DSS compliance. He is an author of books "Security Warrior", "PCI Compliance", "Logging and Log Management" and a contributor to "Know Your Enemy II", "Information Security Management Handbook" and others. Anton has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI DSS, honeypots, etc. His blog securitywarrior.org was one of the most popular in the industry.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#261 - Scaling MSP & MSSP Services with Hannah Lloyd, Co-Founder / CRO of enhanced.io Oct 29, 2025

Show notes

On this episode of The Cybersecurity Defenders Podcast we speak with Hannah Lloyd, Co-Founder and CRO of enhanced.io, about how MSPs can launch, sell and scale security offerings.

With 10+ years of channel sales experience, Hannah leads global new business generation and account management to deliver innovative cybersecurity solutions to enhanced.io’s MSP partners. As a GTIA EC member (2018) and Chair (2021), Hannah is actively involved in the MSP channel community.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#260 - Intel Chat: Kansas City National Security Campus breach, COLDRIVER, new KEV catalog additions & AWS outage Oct 27, 2025

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A breach at the Kansas City National Security Campus (KCNSC), a facility responsible for manufacturing roughly 80% of the non-nuclear components for U.S. nuclear weapons, was enabled by two critical Microsoft SharePoint vulnerabilities.
COLDRIVER, a Russian state-sponsored group also tracked as UNC4057, Callisto, or Star Blizzard, has shifted rapidly toward new malware development following the public exposure of its previous malware, LOSTKEYS, in May 2025.
CISA has officially added three newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, urging swift remediation efforts across federal environments. Newer article link.
Amazon Web Services (AWS) experienced a major outage on October 20th that impacted thousands of applications globally, disrupting operations for companies and end-users alike.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#259 - Defender Fridays: Breaking Down Microsoft Defender for Endpoint with Ken Westin from LimaCharlie Oct 24, 2025

Show notes

Ken, Senior Solutions Engineer at LimaCharlie, dives into the incredibly confusing licensing tiers, pricing models and feature sets for Microsoft Defender for Endpoint. Today we discuss:

The difference between tiers
Ways to solve Defender visibility issues and increase operational transparency
How its capabilities can be customized and expanded for better flexibility and scalability for service providers

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

A big picture thinker, Ken ferrets out trends, seeking to understand what happens when businesses are breached and the methods behind the attacks. Then he figures out how to protect customers before they’re hit.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastruture for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at limacharlie.io.

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Cybersecurity Defenders Podcast

Related Podcasts

Links

Stay Connected