Talos Takes Wed, 15 Jan 2025 09:05:18 -0500 https://www.talosintelligence.com/podcasts en-us © 2025 Talos Takes yes aa497bd0-84eb-59b0-9141-4461b1ddbd5a Cisco Talos episodic false Every week, host Hazel Burton brings on a new guest from Talos or the broader Cisco Security world to break down a complicated security topic. We cover everything from breaking news to attacker trends and emerging threats.

]]> Buzzsprout (https://www.buzzsprout.com) Cisco Talos https://storage.buzzsprout.com/3ezljc91h7jwm92kpbaoeacgvxe5?.jpg Talos Takes https://www.talosintelligence.com/podcasts Hazel Burton Exploring vulnerable Windows drivers Exploring vulnerable Windows drivers Hazel sits down with Vanja Svajcer from Talos' threat research team. Vanja is a prolific malware hunter and this time he's here to talk about vulnerable Windows drivers. We've been covering these drivers quite a bit on the Talos blog over the last year, and during our research we investigated classes of vulnerabilities typically exploited by threat actors as well as the payloads they typically deploy post-exploitation. The attacks in which attackers are deliberately installing known vulnerable drivers only to later exploit them is a technique referred to as Bring Your Own Vulnerable Driver (BYOVD). 

If you're curious about this topic and the recommendations our team has to help you address vulnerable drivers in your environment, then this episode is for you. 

The full research can be found at https://blog.talosintelligence.com/exploring-vulnerable-windows-drivers/

]]> Hazel sits down with Vanja Svajcer from Talos' threat research team. Vanja is a prolific malware hunter and this time he's here to talk about vulnerable Windows drivers. We've been covering these drivers quite a bit on the Talos blog over the last year, and during our research we investigated classes of vulnerabilities typically exploited by threat actors as well as the payloads they typically deploy post-exploitation. The attacks in which attackers are deliberately installing known vulnerable drivers only to later exploit them is a technique referred to as Bring Your Own Vulnerable Driver (BYOVD). 

If you're curious about this topic and the recommendations our team has to help you address vulnerable drivers in your environment, then this episode is for you. 

The full research can be found at https://blog.talosintelligence.com/exploring-vulnerable-windows-drivers/

]]> Cisco Talos Buzzsprout-16436172 Wed, 15 Jan 2025 05:00:00 -0500 924 full false It's the 35th anniversary of ransomware - let's talk about the major shifts and changes It's the 35th anniversary of ransomware - let's talk about the major shifts and changes Ransomware is 35 years old this month, which isn't exactly something to celebrate. But in any case, do join Hazel and special guest Martin Lee to discuss what happened in the very first ransomware incident in December 1989 and why IT "wasn't ready". 

They then discuss how ransomware evolved to become the criminal entity it is today, which involves looking back on the likes of SamSam, Maze and the emergence of crypto currencies. Plus, learn why Martin says we shouldn't feel powerless in the face of ransomware.

]]> Ransomware is 35 years old this month, which isn't exactly something to celebrate. But in any case, do join Hazel and special guest Martin Lee to discuss what happened in the very first ransomware incident in December 1989 and why IT "wasn't ready". 

They then discuss how ransomware evolved to become the criminal entity it is today, which involves looking back on the likes of SamSam, Maze and the emergence of crypto currencies. Plus, learn why Martin says we shouldn't feel powerless in the face of ransomware.

]]> Cisco Talos Buzzsprout-16254941 Wed, 11 Dec 2024 08:00:00 -0500 1408 full false Unwrapping the emerging Interlock ransomware attack Unwrapping the emerging Interlock ransomware attack Chetan Raghuprasad is our guest today as he breaks down the relatively new Interlock ransomware attack. Cisco Talos Incident Response recently observed this attacker conducting big-game hunting and double extortion attacks. 

Chetan talks about the initial access tactics, deployment of the ransomware encryptor, and how Interlock communicates with its victims using their “Worldwide Secrets Blog”.

For the full analysis, head to https://blog.talosintelligence.com/emerging-interlock-ransomware/

]]> Chetan Raghuprasad is our guest today as he breaks down the relatively new Interlock ransomware attack. Cisco Talos Incident Response recently observed this attacker conducting big-game hunting and double extortion attacks. 

Chetan talks about the initial access tactics, deployment of the ransomware encryptor, and how Interlock communicates with its victims using their “Worldwide Secrets Blog”.

For the full analysis, head to https://blog.talosintelligence.com/emerging-interlock-ransomware/

]]> Cisco Talos Buzzsprout-16091012 Thu, 14 Nov 2024 05:00:00 -0500 902 full false It's Taplunk! Talos and Splunk threat researchers meet to put the security world to rights It's Taplunk! Talos and Splunk threat researchers meet to put the security world to rights What happens when two sets of threat researchers from Talos and Splunk's SURGe team meet? Aside from some highly controversial opinions and omissions about the best horror movie, the team discuss what security trends are FUD, and what's actually fearful/ most challenging at the moment. Also, what is the security industry not aware of enough, and also too aware of? Plus some thoughts on cybersecurity awareness training and how we can do better.

This is a great conversation facilitated by SURGe's Mick Baccio, with Joe Marshall and Nick Biasini from Talos, and Tamara Chacon and Audra Streetman from SURGe.

Catch up on all the latest and greatest threat research from our friends at SURGe at https://www.splunk.com/en_us/surge.html

]]> What happens when two sets of threat researchers from Talos and Splunk's SURGe team meet? Aside from some highly controversial opinions and omissions about the best horror movie, the team discuss what security trends are FUD, and what's actually fearful/ most challenging at the moment. Also, what is the security industry not aware of enough, and also too aware of? Plus some thoughts on cybersecurity awareness training and how we can do better.

This is a great conversation facilitated by SURGe's Mick Baccio, with Joe Marshall and Nick Biasini from Talos, and Tamara Chacon and Audra Streetman from SURGe.

Catch up on all the latest and greatest threat research from our friends at SURGe at https://www.splunk.com/en_us/surge.html

]]> Cisco Talos Buzzsprout-16010726 Thu, 31 Oct 2024 05:00:00 -0400 3038 full false The biggest takeaways from Talos IR's new report: New ransomware variants, EDR tool uninstallation, and password spray attacks increasing The biggest takeaways from Talos IR's new report: New ransomware variants, EDR tool uninstallation, and password spray attacks increasing The Talos IR Quarterly Trends Q3 2024 is out now! In this episode Hazel Burton, Craig Jackson and Bill Largent discuss three big themes: some new ransomware players, the 'Bring Your Own Vulnerable Driver' trend, and why password spray attacks are making a comeback. 

Check out the full report at https://blog.talosintelligence.com/incident-response-trends-q3-2024/

]]> The Talos IR Quarterly Trends Q3 2024 is out now! In this episode Hazel Burton, Craig Jackson and Bill Largent discuss three big themes: some new ransomware players, the 'Bring Your Own Vulnerable Driver' trend, and why password spray attacks are making a comeback. 

Check out the full report at https://blog.talosintelligence.com/incident-response-trends-q3-2024/

]]> Cisco Talos Buzzsprout-15989360 Fri, 25 Oct 2024 05:00:00 -0400 926 full false How Talos IR and Splunk are teaming up How Talos IR and Splunk are teaming up Hazel Burton steps in as guest host this week to talk to Brad Garnett, the head of Cisco Talos Incident Response, and JK Lialias, the head of cybersecurity product marketing for Splunk. Brad and JK share two exciting in which Talos is being incorporated into Splunk now, and what that means for the ways we can keep users more secure. They also talk about what better visibility into attacker trends means for the end user and defenders.

]]> Hazel Burton steps in as guest host this week to talk to Brad Garnett, the head of Cisco Talos Incident Response, and JK Lialias, the head of cybersecurity product marketing for Splunk. Brad and JK share two exciting in which Talos is being incorporated into Splunk now, and what that means for the ways we can keep users more secure. They also talk about what better visibility into attacker trends means for the end user and defenders.

]]> Cisco Talos Buzzsprout-15740949 Fri, 13 Sep 2024 04:00:00 -0400 1281 197 full false Why the BlackByte ransomware group may be more active than we initially thought Why the BlackByte ransomware group may be more active than we initially thought James Nutland from Talos' Threat Intelligence team joins the show this week to talk to Jon about his report on the BlackByte ransomware group. They cover why this group is actually more active than we initially thought, and check on the general state of ransomware at this point in 2024. 

]]> James Nutland from Talos' Threat Intelligence team joins the show this week to talk to Jon about his report on the BlackByte ransomware group. They cover why this group is actually more active than we initially thought, and check on the general state of ransomware at this point in 2024. 

]]> Cisco Talos Buzzsprout-15702235 Fri, 06 Sep 2024 04:00:00 -0400 561 196 full false AI, critical infrastructure dominate conversation at Hacker Summer Camp AI, critical infrastructure dominate conversation at Hacker Summer Camp It's quite the gang for Talos Takes this week with Joe Marshall, Nick Biasini and Mick Baccio (from Splunk's SURGe team) joining Jon this week to recap Black Hat and DEF CON. They share all the conversations and talking points they heard around AI, and the renewed importance of a software bill of goods for industrial control system environments. 

]]> It's quite the gang for Talos Takes this week with Joe Marshall, Nick Biasini and Mick Baccio (from Splunk's SURGe team) joining Jon this week to recap Black Hat and DEF CON. They share all the conversations and talking points they heard around AI, and the renewed importance of a software bill of goods for industrial control system environments. 

]]> Cisco Talos Buzzsprout-15624844 Fri, 23 Aug 2024 04:00:00 -0400 847 195 full false A 1-on-1 with Talos VP Matt Watchinski A 1-on-1 with Talos VP Matt Watchinski He's been here since the beginning, and now he's ready to reflect on the past 10 years of Cisco Talos. Matt Watchinski, the Vice President of Talos for Cisco, joins Jon this week to talk about Talos' recently celebrated 10th birthday and talk about the company's origins, how we've managed to balance growth and culture, and his favorite memories from the past 10 years. 

]]> He's been here since the beginning, and now he's ready to reflect on the past 10 years of Cisco Talos. Matt Watchinski, the Vice President of Talos for Cisco, joins Jon this week to talk about Talos' recently celebrated 10th birthday and talk about the company's origins, how we've managed to balance growth and culture, and his favorite memories from the past 10 years. 

]]> Cisco Talos Buzzsprout-15583077 Fri, 16 Aug 2024 04:00:00 -0400 1804 194 full false What should we be doing to better support open-source software? What should we be doing to better support open-source software? People who maintain, create and update open-source software are the unsung heroes of the internet. Their work keeps much of our networks running on a daily basis, and the vast majority of them do it for free! While there are some security pitfalls that can come with using OS software, Martin Lee and Jon get together to discuss what (if anything) we can be doing to better support OS software, and how to make our networks more resilient against vulnerabilities that can arise in these tools.  

]]> People who maintain, create and update open-source software are the unsung heroes of the internet. Their work keeps much of our networks running on a daily basis, and the vast majority of them do it for free! While there are some security pitfalls that can come with using OS software, Martin Lee and Jon get together to discuss what (if anything) we can be doing to better support OS software, and how to make our networks more resilient against vulnerabilities that can arise in these tools.  

]]> Cisco Talos Buzzsprout-15515658 Fri, 02 Aug 2024 04:00:00 -0400 663 193 full false Threat actor trends and the most prevalent malware from the past quarter Threat actor trends and the most prevalent malware from the past quarter Hazel Burton guest hosts this week to recap the top threats observed by Cisco Talos Incident Response (Talos IR) in the second quarter of 2024. She’s then joined by Talos’ Joe Marshall and Craig Jackson to pick out some of the most interesting stories from the report.

]]> Hazel Burton guest hosts this week to recap the top threats observed by Cisco Talos Incident Response (Talos IR) in the second quarter of 2024. She’s then joined by Talos’ Joe Marshall and Craig Jackson to pick out some of the most interesting stories from the report.

]]> Cisco Talos Buzzsprout-15474516 Fri, 26 Jul 2024 04:00:00 -0400 957 192 full false You got a data breach notification. Now what? You got a data breach notification. Now what? Joe Marshall, Talos' resident ICS and IoT expert, and Pierre Cadieux from Talos Incident Response join Jon this week to discuss data breaches. Between Snowflake, AT&T, Ticketmaster and more, we should probably assume our data has been part of a leak somewhere. So what steps should you take to prepare for this inevitability? Or what should you do when you get a data breach notification from a company?

]]> Joe Marshall, Talos' resident ICS and IoT expert, and Pierre Cadieux from Talos Incident Response join Jon this week to discuss data breaches. Between Snowflake, AT&T, Ticketmaster and more, we should probably assume our data has been part of a leak somewhere. So what steps should you take to prepare for this inevitability? Or what should you do when you get a data breach notification from a company?

]]> Cisco Talos Buzzsprout-15434973 Fri, 19 Jul 2024 04:00:00 -0400 1323 191 full false What we learned from studying the TTPs of the 14 most active ransomware groups What we learned from studying the TTPs of the 14 most active ransomware groups Fresh off an analysis of the 14 most active ransomware groups, James Nutland joins Jon this week to discuss his findings. They talk about the most common TTPs shared among these groups, and the potential outliers among these gangs and how they try to infect victims. For more on this topic, watch the inaugural episode of "The Talos Threat Perspective." 

]]> Fresh off an analysis of the 14 most active ransomware groups, James Nutland joins Jon this week to discuss his findings. They talk about the most common TTPs shared among these groups, and the potential outliers among these gangs and how they try to infect victims. For more on this topic, watch the inaugural episode of "The Talos Threat Perspective." 

]]> Cisco Talos Buzzsprout-15398290 Fri, 12 Jul 2024 04:00:00 -0400 495 190 full false Time to catch up on the wide-reaching Snowflake incident Time to catch up on the wide-reaching Snowflake incident Over 160 companies have been affected by a data breach at data storage company Snowflake, including Ticketmaster, Nieman Marcus and more. But the issue wasn't a security vulnerability or some sophisticated malware — it was just someone who exposed their login credentials at a different company. Host Jon Munshaw got Pierre Cadieux from Talos IR and Nick Biasini from Talos Outreach to discuss the follow-on breaches that have resulted from this and the lessons we can learn about making our login credentials more secure. 

]]> Over 160 companies have been affected by a data breach at data storage company Snowflake, including Ticketmaster, Nieman Marcus and more. But the issue wasn't a security vulnerability or some sophisticated malware — it was just someone who exposed their login credentials at a different company. Host Jon Munshaw got Pierre Cadieux from Talos IR and Nick Biasini from Talos Outreach to discuss the follow-on breaches that have resulted from this and the lessons we can learn about making our login credentials more secure. 

]]> Cisco Talos Buzzsprout-15322932 Fri, 28 Jun 2024 04:00:00 -0400 1017 189 full false Everything we know about denial-of-service attacks in 2024 Everything we know about denial-of-service attacks in 2024 You may think a DDoS attack is so early aughts. But some of the largest attacks of this type have occurred in just the past few years. Talos recently updated our advice for how to best mitigate and prepare for this threat, so Aliza Johnson from Talos' Threat Intelligence & Interdiction team joins the show this week to discuss her recent findings and hacktivists' trends around using this threat. 

]]> You may think a DDoS attack is so early aughts. But some of the largest attacks of this type have occurred in just the past few years. Talos recently updated our advice for how to best mitigate and prepare for this threat, so Aliza Johnson from Talos' Threat Intelligence & Interdiction team joins the show this week to discuss her recent findings and hacktivists' trends around using this threat. 

]]> Cisco Talos Buzzsprout-15283954 Fri, 21 Jun 2024 04:00:00 -0400 610 188 full false The many shades of LilacSquid The many shades of LilacSquid Anna Bennett, one of Talos' threat hunters, joins the show this week to talk about one of her recent findings — the LilacSquid APT. This is a newly discovered threat actor that Talos found hiding on networks for months and years at a time, silently stealing sensitive information the entire time. Anna discusses LilacSquid's activities, potential motivations, and how they overlap with North Korean APTs. 

]]> Anna Bennett, one of Talos' threat hunters, joins the show this week to talk about one of her recent findings — the LilacSquid APT. This is a newly discovered threat actor that Talos found hiding on networks for months and years at a time, silently stealing sensitive information the entire time. Anna discusses LilacSquid's activities, potential motivations, and how they overlap with North Korean APTs. 

]]> Cisco Talos Buzzsprout-15246340 Fri, 14 Jun 2024 04:00:00 -0400 600 187 full false A mid-year checkin on Volt Typhoon A mid-year checkin on Volt Typhoon The Volt Typhoon threat actor is one of the longest-running cybersecurity storylines this year. The Chinese state-sponsored actor has already been accused of a range of attacks, specifically targeting critical infrastructure and U.S. military bases. Since it's been a few months without any new developments with this group, we thought it'd be a good idea to check in with Talos' Threat Intelligence and Interdiction team on what's going on with this actor, and if they're up to anything new. 

]]> The Volt Typhoon threat actor is one of the longest-running cybersecurity storylines this year. The Chinese state-sponsored actor has already been accused of a range of attacks, specifically targeting critical infrastructure and U.S. military bases. Since it's been a few months without any new developments with this group, we thought it'd be a good idea to check in with Talos' Threat Intelligence and Interdiction team on what's going on with this actor, and if they're up to anything new. 

]]> Cisco Talos Buzzsprout-15197778 Fri, 07 Jun 2024 04:00:00 -0400 680 186 full false How much has AI helped bad actors who spread disinformation? How much has AI helped bad actors who spread disinformation? Inspired by his quotes in a recent CNBC article, Jon Munshaw wanted to have Martin Lee on the show this week to discuss AI and how adversaries can use these tools to create deepfakes and disinformation. Martin shares why he thinks the threats of increasing fake news with the advent of AI tools are a bit overblown, and how the dangers in spreading fake news come more from text-based posts than any deepfake video or audio. If you'd like to learn more about how to detect potential deepfake videos or fake news articles, check out the additional resources here and here.

]]> Inspired by his quotes in a recent CNBC article, Jon Munshaw wanted to have Martin Lee on the show this week to discuss AI and how adversaries can use these tools to create deepfakes and disinformation. Martin shares why he thinks the threats of increasing fake news with the advent of AI tools are a bit overblown, and how the dangers in spreading fake news come more from text-based posts than any deepfake video or audio. If you'd like to learn more about how to detect potential deepfake videos or fake news articles, check out the additional resources here and here.

]]> Cisco Talos Buzzsprout-15165250 Fri, 31 May 2024 04:00:00 -0400 1160 185 full false Recapping RSA Recapping RSA Nicole Hoffman, fresh off her trip to the RSA Conference, joins host Jon Munshaw this week to talk about her major takeaways from the week in San Francisco. Nicole talks about how most of the discussions on the floor centered around AI, and what lessons other defenders are learning from some of our past mistakes. If you'd like to check out Nicole's other work, buy her children's cybersecurity books on Amazon. 

]]> Nicole Hoffman, fresh off her trip to the RSA Conference, joins host Jon Munshaw this week to talk about her major takeaways from the week in San Francisco. Nicole talks about how most of the discussions on the floor centered around AI, and what lessons other defenders are learning from some of our past mistakes. If you'd like to check out Nicole's other work, buy her children's cybersecurity books on Amazon. 

]]> Cisco Talos Buzzsprout-15081791 Fri, 17 May 2024 04:00:00 -0400 735 184 full false Why CoralRaider is looking to steal your login credentials Why CoralRaider is looking to steal your login credentials Joey Chen from Talos' Outreach team is here to tell us all about his research into the CoralRaider threat actor. He's helped write two posts on the recently discovered APT, disclosing new information about how this Vietnamese-based actor is targeting login credentials. After stealing those credentials, they go on to try and sell them on the dark web, or use them to try and brute force their way into more important accounts. Joey discusses what this actor is really after, and why they've been growing so quickly. 

]]> Joey Chen from Talos' Outreach team is here to tell us all about his research into the CoralRaider threat actor. He's helped write two posts on the recently discovered APT, disclosing new information about how this Vietnamese-based actor is targeting login credentials. After stealing those credentials, they go on to try and sell them on the dark web, or use them to try and brute force their way into more important accounts. Joey discusses what this actor is really after, and why they've been growing so quickly. 

]]> Cisco Talos Buzzsprout-15041600 Fri, 10 May 2024 04:00:00 -0400 405 183 full false 4 takeaways from what Talos IR is seeing in the field 4 takeaways from what Talos IR is seeing in the field Hazel Burton steps in to host this week's episode as we cover the recent Cisco Talos Incident Response Quarterly Trends Report from the first quarter of this year. Hazel talks to different Talosians to find out why business email compromise is on the rise, how attackers are bypassing MFA, and more. 

]]> Hazel Burton steps in to host this week's episode as we cover the recent Cisco Talos Incident Response Quarterly Trends Report from the first quarter of this year. Hazel talks to different Talosians to find out why business email compromise is on the rise, how attackers are bypassing MFA, and more. 

]]> Cisco Talos Buzzsprout-14998535 Fri, 03 May 2024 04:00:00 -0400 855 182 full false How to defend against brute force attacks How to defend against brute force attacks After a recent spike in brute force attempts targeting SSH and VPN services, we felt it was a good time to give listeners a lesson on brute force attacks. Nick Biasini joins host Jon Munshaw this week to discuss the basics of these methods, how administrators can protect their accounts, and other potential defense mechanisms (or whether to just take passwords out of the equation entirely). 

]]> After a recent spike in brute force attempts targeting SSH and VPN services, we felt it was a good time to give listeners a lesson on brute force attacks. Nick Biasini joins host Jon Munshaw this week to discuss the basics of these methods, how administrators can protect their accounts, and other potential defense mechanisms (or whether to just take passwords out of the equation entirely). 

]]> Cisco Talos Buzzsprout-14956921 Fri, 26 Apr 2024 04:00:00 -0400 450 181 full false What are the dangers of enabling sideloading and third-party apps? What are the dangers of enabling sideloading and third-party apps? Apple now must allow users to be able to sideload apps onto their phones or access third-party app stores, thanks to a law from the European Union that went into effect earlier this year. Terryn Valikodath from Cisco Talos Incident Response joins Jon this week to discuss the potential dangers that come with allowing users to sideload apps onto their devices, and how attackers may take advantage of this new opening. 

]]> Apple now must allow users to be able to sideload apps onto their phones or access third-party app stores, thanks to a law from the European Union that went into effect earlier this year. Terryn Valikodath from Cisco Talos Incident Response joins Jon this week to discuss the potential dangers that come with allowing users to sideload apps onto their devices, and how attackers may take advantage of this new opening. 

]]> Cisco Talos Buzzsprout-14913975 Fri, 19 Apr 2024 04:00:00 -0400 624 180 full false Why we need to stop calling as-a-service group takedowns "takedowns" Why we need to stop calling as-a-service group takedowns "takedowns" Hazel Burton and Thorsten Rosendahl join Jon Munshaw on this week's episode to discuss the problem with threat actor "hydras." They recently wrote about the topic for the Talos blog, highlighting how law enforcement takedowns of these groups are closer to just disruptions or setbacks for these massive actors. They talk about what really needs to be done to stop ransomware actors and why RaaS is a breeding ground for "hydras."

]]> Hazel Burton and Thorsten Rosendahl join Jon Munshaw on this week's episode to discuss the problem with threat actor "hydras." They recently wrote about the topic for the Talos blog, highlighting how law enforcement takedowns of these groups are closer to just disruptions or setbacks for these massive actors. They talk about what really needs to be done to stop ransomware actors and why RaaS is a breeding ground for "hydras."

]]> Cisco Talos Buzzsprout-14871755 Fri, 12 Apr 2024 04:00:00 -0400 740 179 full false Turla has been around for 20-plus years at this point, but they're still mixing things up Turla has been around for 20-plus years at this point, but they're still mixing things up Holger Unterbrink of Talos Outreach joins the show this week to discuss his recent Turla APT research. This Russian state-sponsored actor has been around for years but is regularly adding new tooling to its arsenal. Holger has new details about their latest tool, TinyTurlaNG, and insight into the types of organizations they're targeting.

]]> Holger Unterbrink of Talos Outreach joins the show this week to discuss his recent Turla APT research. This Russian state-sponsored actor has been around for years but is regularly adding new tooling to its arsenal. Holger has new details about their latest tool, TinyTurlaNG, and insight into the types of organizations they're targeting.

]]> Cisco Talos Buzzsprout-14828941 Fri, 05 Apr 2024 04:00:00 -0400 544 178 full false Why more actors are starting to use Telegram for their communications Why more actors are starting to use Telegram for their communications Jon started noticing that Talos is finding more threat actors using Telegram nowadays for their communication and coordination, so he decided to bring Azim Khodjibaev on to ask him if he was just inventing this, or if it was a real trend. Turns out it's a real trend! Azim fills listeners in on why Telegram is becoming the app of choice for APTs to publish "news," threaten data leaks, and more. 

]]> Jon started noticing that Talos is finding more threat actors using Telegram nowadays for their communication and coordination, so he decided to bring Azim Khodjibaev on to ask him if he was just inventing this, or if it was a real trend. Turns out it's a real trend! Azim fills listeners in on why Telegram is becoming the app of choice for APTs to publish "news," threaten data leaks, and more. 

]]> Cisco Talos Buzzsprout-14737004 Fri, 22 Mar 2024 04:00:00 -0400 625 177 full false Why no one should be relying on passive security in 2024 Why no one should be relying on passive security in 2024 Nick Biasini joins Jon this week to talk about passive security. He recently wrote about this topic for the Talos blog and joined Wendy Nather in discussing the merits of passive security versus active blocking. Nick defines what passive security is, exactly, and why it's not the way to go in the modern age. 

]]> Nick Biasini joins Jon this week to talk about passive security. He recently wrote about this topic for the Talos blog and joined Wendy Nather in discussing the merits of passive security versus active blocking. Nick defines what passive security is, exactly, and why it's not the way to go in the modern age. 

]]> Cisco Talos Buzzsprout-14691854 Fri, 15 Mar 2024 04:00:00 -0400 497 176 full false What's new about GhostSec's ransomware-as-a-service model What's new about GhostSec's ransomware-as-a-service model Chetan Raghuprasad from the Talos Outreach team joins Talos Takes this week to talk to Jon about the GhostSec threat actor that he and a few colleagues wrote about for the Talos blog. GhostSec has teamed up with another ransomware group to carry out double extortion attacks all over the globe, with increasing frequency over the past year. They discuss what's unique about this particular RaaS model, where GhostSec came from, and the benefits of going in on a team-up. 

]]> Chetan Raghuprasad from the Talos Outreach team joins Talos Takes this week to talk to Jon about the GhostSec threat actor that he and a few colleagues wrote about for the Talos blog. GhostSec has teamed up with another ransomware group to carry out double extortion attacks all over the globe, with increasing frequency over the past year. They discuss what's unique about this particular RaaS model, where GhostSec came from, and the benefits of going in on a team-up. 

]]> Cisco Talos Buzzsprout-14646742 Fri, 08 Mar 2024 04:00:00 -0500 726 175 full false Why are "identity attacks" on the rise? Why are "identity attacks" on the rise? Now more than ever, adversaries are logging in, not breaking in. They're stealing legitimate user credentials to hide undetected on a targeted network after acquiring said credentials in a variety of ways. Hazel Burton joins Jon Munshaw this week to discuss identity attacks, recommendations for avoiding them, and how QR code phishing plays into these tactics. 

]]> Now more than ever, adversaries are logging in, not breaking in. They're stealing legitimate user credentials to hide undetected on a targeted network after acquiring said credentials in a variety of ways. Hazel Burton joins Jon Munshaw this week to discuss identity attacks, recommendations for avoiding them, and how QR code phishing plays into these tactics. 

]]> Cisco Talos Buzzsprout-14601396 Fri, 01 Mar 2024 04:00:00 -0500 689 174 full false The tl;dr of NIS2 The tl;dr of NIS2 Gergana Karadzhova-Dangela and Thorsten Rosendahl, our resident experts on all things European Union cybersecurity law, join the show this week to talk about the impending NIS2 regulations. Don't worry, you've still got plenty of time to work on them, but this is a good place to get started even if you've never seen the phrase "NIS2" before. Find more of their writing on NIS2 here and here. 

]]> Gergana Karadzhova-Dangela and Thorsten Rosendahl, our resident experts on all things European Union cybersecurity law, join the show this week to talk about the impending NIS2 regulations. Don't worry, you've still got plenty of time to work on them, but this is a good place to get started even if you've never seen the phrase "NIS2" before. Find more of their writing on NIS2 here and here. 

]]> Cisco Talos Buzzsprout-14556495 Fri, 23 Feb 2024 04:00:00 -0500 845 173 full false Case study: How Talos IR helped a healthcare tech company avoid a ransomware attack Case study: How Talos IR helped a healthcare tech company avoid a ransomware attack Reposted from the Cisco Security Stories feed: Meet Jeremy Maxwell, CISO of Veradigm, a healthcare IT company. Jeremy discusses how his organization proactively prepares for cybersecurity incidents within a highly regulated industry.

]]> Reposted from the Cisco Security Stories feed: Meet Jeremy Maxwell, CISO of Veradigm, a healthcare IT company. Jeremy discusses how his organization proactively prepares for cybersecurity incidents within a highly regulated industry.

]]> Cisco Talos Buzzsprout-14515959 Fri, 16 Feb 2024 09:00:00 -0500 2960 172 full false How are attackers using malicious drivers in Windows to stay undetected? How are attackers using malicious drivers in Windows to stay undetected? Chris Neal from Talos Outreach joins the show today to talk about his research into the ways adversaries are using malicious drivers on Windows to spread malware. He recently launched a new series on the Talos blog about the basics of drivers and how security researchers can reverse engineer them to learn more about attacker TTPs and develop new detection content. Chris discusses when he first spotted this type of attack, what advantages it presents for the attacker and the other aspects of the research he plans to dive into.

]]> Chris Neal from Talos Outreach joins the show today to talk about his research into the ways adversaries are using malicious drivers on Windows to spread malware. He recently launched a new series on the Talos blog about the basics of drivers and how security researchers can reverse engineer them to learn more about attacker TTPs and develop new detection content. Chris discusses when he first spotted this type of attack, what advantages it presents for the attacker and the other aspects of the research he plans to dive into.

]]> Cisco Talos Buzzsprout-14423280 Fri, 02 Feb 2024 04:00:00 -0500 696 171 full false (XL Edition): Talos IR recaps the top threats of Q4 2023 (XL Edition): Talos IR recaps the top threats of Q4 2023 This week, we're bringing you the audio version of our recent Talos IR On Air video. Several Talos incident responders got together to recap the top threats and attacker trends of Q4 2023, as outlined in our full Quarterly Trends Report. Hear about why ransomware was up for the first time the entire year, and which sectors were being targeted most often. 

]]> This week, we're bringing you the audio version of our recent Talos IR On Air video. Several Talos incident responders got together to recap the top threats and attacker trends of Q4 2023, as outlined in our full Quarterly Trends Report. Hear about why ransomware was up for the first time the entire year, and which sectors were being targeted most often. 

]]> Cisco Talos Buzzsprout-14378310 Fri, 26 Jan 2024 04:00:00 -0500 1038 170 full false What's new with CVSS 4.0, and does it really change anything? What's new with CVSS 4.0, and does it really change anything? We're talking about vulnerabilities this week with Jerry Gamblin from Cisco Vulnerability Management. Jerry joins the show to talk about the release of CVSS 4.0 this year — the newest method the security community will use to score the severity of certain vulnerabilities. Jerry discusses what makes this scoring system different from previous iterations if it changes how he views the term "severe" and how that fits into Cisco's overall vulnerability management processes. 

]]> We're talking about vulnerabilities this week with Jerry Gamblin from Cisco Vulnerability Management. Jerry joins the show to talk about the release of CVSS 4.0 this year — the newest method the security community will use to score the severity of certain vulnerabilities. Jerry discusses what makes this scoring system different from previous iterations if it changes how he views the term "severe" and how that fits into Cisco's overall vulnerability management processes. 

]]> Cisco Talos Buzzsprout-14334877 Fri, 19 Jan 2024 04:00:00 -0500 569 169 full false XL Edition: Talos' 2023 Year in Review XL Edition: Talos' 2023 Year in Review In this special edition of the show, we're bringing you the audio version of our Year in Review livestream. Recorded at the end of December, this stream included Hazel Burton, Nick Biasini and Laurie Varner from Cisco Talos Incident Response recapping the year that was in cybersecurity. They covered the highlights of our 2023 Year in Review report, their personal takeaways from the past year, and trends to watch for heading into the new year.

]]> In this special edition of the show, we're bringing you the audio version of our Year in Review livestream. Recorded at the end of December, this stream included Hazel Burton, Nick Biasini and Laurie Varner from Cisco Talos Incident Response recapping the year that was in cybersecurity. They covered the highlights of our 2023 Year in Review report, their personal takeaways from the past year, and trends to watch for heading into the new year.

]]> Cisco Talos Buzzsprout-14292397 Fri, 12 Jan 2024 03:00:00 -0500 2091 168 full false Year in Review: Why are attackers targeting the telecommunications sector so often? Year in Review: Why are attackers targeting the telecommunications sector so often? We're back from holiday break with the first new Talos Takes episode of 2024! We're continuing our dive into Talos' Year in Review report with Lexi DiSchola, one of the many researchers who helped put this report together. She discusses why we believe the telecommunications sector was the most-targeted industry in 2023, advice for companies in that space, and other popular targets for attackers. 

]]> We're back from holiday break with the first new Talos Takes episode of 2024! We're continuing our dive into Talos' Year in Review report with Lexi DiSchola, one of the many researchers who helped put this report together. She discusses why we believe the telecommunications sector was the most-targeted industry in 2023, advice for companies in that space, and other popular targets for attackers. 

]]> Cisco Talos Buzzsprout-14248718 Fri, 05 Jan 2024 04:00:00 -0500 450 167 full false Year in Review: Why was 2023 the year of data theft extortion? Year in Review: Why was 2023 the year of data theft extortion? Jon apologizes for how he sounds in this episode, he was having mic troubles we discovered only during post-production. But outside of that, we continue the series of episodes recapping 2023 with our Year in Review report. This week, Aliza Johnson from the Talos Threat Intelligence & Interdiction team comes on the show to talk about data theft extortion. She shares why her team saw such a spike in this type of activity in 2023, what can be done to stop it, and which ransomware actors are pivoting to this tactic. 

]]> Jon apologizes for how he sounds in this episode, he was having mic troubles we discovered only during post-production. But outside of that, we continue the series of episodes recapping 2023 with our Year in Review report. This week, Aliza Johnson from the Talos Threat Intelligence & Interdiction team comes on the show to talk about data theft extortion. She shares why her team saw such a spike in this type of activity in 2023, what can be done to stop it, and which ransomware actors are pivoting to this tactic. 

]]> Cisco Talos Buzzsprout-14149300 Fri, 15 Dec 2023 04:00:00 -0500 559 166 full false 2023 Year in Review: Everything you need to know about Chinese state-sponsored actors 2023 Year in Review: Everything you need to know about Chinese state-sponsored actors To celebrate the launch of our 2023 Year in Review report, we're doing a series of episodes highlighting several of our key takeaways from the past year. First up, we have David Liebenberg from our Threat Intelligence team to discuss Chinese state-sponsored actors. This is an area David's been studying for many years now and actively researches. He'll discuss the latest Chinese APTs to step onto the scene and trends he's seeing from that area of the world. 

]]> To celebrate the launch of our 2023 Year in Review report, we're doing a series of episodes highlighting several of our key takeaways from the past year. First up, we have David Liebenberg from our Threat Intelligence team to discuss Chinese state-sponsored actors. This is an area David's been studying for many years now and actively researches. He'll discuss the latest Chinese APTs to step onto the scene and trends he's seeing from that area of the world. 

]]> Cisco Talos Buzzsprout-14107994 Fri, 08 Dec 2023 04:00:00 -0500 480 165 full false Inside Talos' effort to protect the Ukrainian power grid Inside Talos' effort to protect the Ukrainian power grid Joe Marshall, a central figure in the story of how Cisco Talos and other teams within Cisco worked together to protect the Ukrainian power grid, joins the show this week. He recaps a recent CNN story highlighting the new piece of equipment he and a group of volunteers worked on together to ensure the clocks that power the Ukrainian electric grid can withstand GPS disruption in the face of Russian cyber attacks and kinetic warfare. 

]]> Joe Marshall, a central figure in the story of how Cisco Talos and other teams within Cisco worked together to protect the Ukrainian power grid, joins the show this week. He recaps a recent CNN story highlighting the new piece of equipment he and a group of volunteers worked on together to ensure the clocks that power the Ukrainian electric grid can withstand GPS disruption in the face of Russian cyber attacks and kinetic warfare. 

]]> Cisco Talos Buzzsprout-14058434 Fri, 01 Dec 2023 04:00:00 -0500 660 164 full false Why has the Phobos ransomware been working for so long? Why has the Phobos ransomware been working for so long? Guilherme Venere from Talos Outreach joins the show this week to talk about his research into the 8Base threat actor and its use of a variant of the Phobos ransomware. He recently published several works on the many variants of Phobos that exist in the wild, and why 8Base has been so successful using it for years now. 

]]> Guilherme Venere from Talos Outreach joins the show this week to talk about his research into the 8Base threat actor and its use of a variant of the Phobos ransomware. He recently published several works on the many variants of Phobos that exist in the wild, and why 8Base has been so successful using it for years now. 

]]> Cisco Talos Buzzsprout-13986245 Fri, 17 Nov 2023 04:00:00 -0500 787 163 full false A warning about scams in "Roblox" (or any other online game, really) A warning about scams in "Roblox" (or any other online game, really) Tiago Pereira from Talos Outreach joins the program this week to talk about his research into the different types of scams that appear in the online game "Roblox." Many underage users are at risk of being targeted by malicious users looking to steal their money, in-game items or even install malware on their devices. 

]]> Tiago Pereira from Talos Outreach joins the program this week to talk about his research into the different types of scams that appear in the online game "Roblox." Many underage users are at risk of being targeted by malicious users looking to steal their money, in-game items or even install malware on their devices. 

]]> Cisco Talos Buzzsprout-13940277 Fri, 10 Nov 2023 04:00:00 -0500 609 162 full false XL Edition: The top incident response trends of Q3 XL Edition: The top incident response trends of Q3 This week is a special edition of Talos Takes. We have the audio version of Talos Incident Response's recent On Air stream, where they discussed the top attacker trends they're seeing in the field. Talos' incident responders discuss the malware they're seeing most often in infections, how attackers are shifting their tactics, and what other defenders can learn from these findings. 

]]> This week is a special edition of Talos Takes. We have the audio version of Talos Incident Response's recent On Air stream, where they discussed the top attacker trends they're seeing in the field. Talos' incident responders discuss the malware they're seeing most often in infections, how attackers are shifting their tactics, and what other defenders can learn from these findings. 

]]> Cisco Talos Buzzsprout-13902020 Fri, 03 Nov 2023 09:00:00 -0400 1845 161 full false Patching 101 Patching 101 Jerry Gamblin from Cisco Kenna joins this week's episode to talk about all things patching. If you're the average user, you probably don't think about patching much because many of them happen automatically in the background. However many admins and users can unknowingly fall behind when it comes to protecting themselves against the latest vulnerabilities. 

]]> Jerry Gamblin from Cisco Kenna joins this week's episode to talk about all things patching. If you're the average user, you probably don't think about patching much because many of them happen automatically in the background. However many admins and users can unknowingly fall behind when it comes to protecting themselves against the latest vulnerabilities. 

]]> Cisco Talos Buzzsprout-13852426 Fri, 27 Oct 2023 04:00:00 -0400 500 160 full false What happens when you actually click the "report spam" button? What happens when you actually click the "report spam" button? Everyone is tired of getting spam emails at this point, and it can feel exhausting always to click that "report spam" button just to get another phony email a few hours later. But we're here to assure you that reporting and filtering spam really does help in the long run! Nick Biasini joins the show this week to discuss all things spam for Cybersecurity Awareness Month. 

]]> Everyone is tired of getting spam emails at this point, and it can feel exhausting always to click that "report spam" button just to get another phony email a few hours later. But we're here to assure you that reporting and filtering spam really does help in the long run! Nick Biasini joins the show this week to discuss all things spam for Cybersecurity Awareness Month. 

]]> Cisco Talos Buzzsprout-13810213 Fri, 20 Oct 2023 04:00:00 -0400 509 159 full false How to find the right password management solution for you How to find the right password management solution for you To continue our Cybersecurity Awareness Month series, Harpreet Singh from Talos Incident Response joins Jon to talk about password managers. They discuss the upside of using a third-party service like 1Password or LastPass, the potential dangers of using built-in browser password managers like Google Chrome and Safari, and other good password hygiene advice. 

]]> To continue our Cybersecurity Awareness Month series, Harpreet Singh from Talos Incident Response joins Jon to talk about password managers. They discuss the upside of using a third-party service like 1Password or LastPass, the potential dangers of using built-in browser password managers like Google Chrome and Safari, and other good password hygiene advice. 

]]> Cisco Talos Buzzsprout-13767299 Fri, 13 Oct 2023 04:00:00 -0400 453 158 full false Cybersecurity Awareness Month: The best practices for implementing multi-factor authentication Cybersecurity Awareness Month: The best practices for implementing multi-factor authentication All of October, we'll be covering broad security-related topics for Cybersecurity Awareness Month. First up, we address the basics of implementing MFA in any environment, why any type of MFA is better than no MFA, the pitfalls of certain types of authentication, and whether going passwordless is the future. 

]]> All of October, we'll be covering broad security-related topics for Cybersecurity Awareness Month. First up, we address the basics of implementing MFA in any environment, why any type of MFA is better than no MFA, the pitfalls of certain types of authentication, and whether going passwordless is the future. 

]]> Cisco Talos Buzzsprout-13724266 Fri, 06 Oct 2023 04:00:00 -0400 976 157 full false Inside a Talos Incident Response emergency event Inside a Talos Incident Response emergency event Hazel Burton takes over as guest host for this episode as she talks to Nate Pors from Cisco Talos Incident Response. Nate was part of Talos IR's team that helped Veradigm, a healthcare technology company, prevent a Qakbot ransomware attack. Nate and his team recently wrote about this experience for the Talos blog, and Veradigm's CISO even joined the Cisco Security Stories podcast recently to discuss his company's relationship with Talos IR. Nate discusses how his team's pre-existing relationship with Veradigm helped them respond quickly and effectively. If you've ever wanted to hear a play-by-play of a security event, this is your chance.

]]> Hazel Burton takes over as guest host for this episode as she talks to Nate Pors from Cisco Talos Incident Response. Nate was part of Talos IR's team that helped Veradigm, a healthcare technology company, prevent a Qakbot ransomware attack. Nate and his team recently wrote about this experience for the Talos blog, and Veradigm's CISO even joined the Cisco Security Stories podcast recently to discuss his company's relationship with Talos IR. Nate discusses how his team's pre-existing relationship with Veradigm helped them respond quickly and effectively. If you've ever wanted to hear a play-by-play of a security event, this is your chance.

]]> Cisco Talos Buzzsprout-13665349 Fri, 29 Sep 2023 03:00:00 -0400 939 156 full false How Talos helped defend Black Hat's network in Vegas How Talos helped defend Black Hat's network in Vegas What happens when the hackers become the hacked? Black Hat is one of the largest cybersecurity conferences in the world, and Talos had a hand in defending the on-site network for the past few years. Yuri Kramarz from Talos Incident Response worked in Black Hat's Network Operations Center this year to help defend Black Hat's network and attendees who connected to the network while attending the conference in August in Las Vegas. He joins Talos Takes this week to discuss what he's learned from the past few years working in the NOC, what types of threats Black Hat faces, and the lessons learned he now takes back into the field with customers. You can also read his reflections on working in the NOC in 2022 here. 

]]> What happens when the hackers become the hacked? Black Hat is one of the largest cybersecurity conferences in the world, and Talos had a hand in defending the on-site network for the past few years. Yuri Kramarz from Talos Incident Response worked in Black Hat's Network Operations Center this year to help defend Black Hat's network and attendees who connected to the network while attending the conference in August in Las Vegas. He joins Talos Takes this week to discuss what he's learned from the past few years working in the NOC, what types of threats Black Hat faces, and the lessons learned he now takes back into the field with customers. You can also read his reflections on working in the NOC in 2022 here. 

]]> Cisco Talos Buzzsprout-13634358 Fri, 22 Sep 2023 03:00:00 -0400 940 155 full false SapphireStealer hits the open internet SapphireStealer hits the open internet Cisco Talos has recently written about malware families that go open-source, sometimes of their own volition, and sometimes because of leaks. In the case of SapphireStealer, we still don't really know why someone posted this malware to GitHub, but now that it's out there, we can't put it back in a box. Edmund Brumaghin, who assisted with Talos' research and blog post on SapphireStealer, joins Talos Takes this week to discuss this information-stealer. Edmund talks about the goals that someone has by making malware open-source, how that affects detection and what makes SapphireStealer unique among infostealers. 

]]> Cisco Talos has recently written about malware families that go open-source, sometimes of their own volition, and sometimes because of leaks. In the case of SapphireStealer, we still don't really know why someone posted this malware to GitHub, but now that it's out there, we can't put it back in a box. Edmund Brumaghin, who assisted with Talos' research and blog post on SapphireStealer, joins Talos Takes this week to discuss this information-stealer. Edmund talks about the goals that someone has by making malware open-source, how that affects detection and what makes SapphireStealer unique among infostealers. 

]]> Cisco Talos Buzzsprout-13554723 Fri, 08 Sep 2023 08:00:00 -0400 443 154 full false You're never going to believe this, but Lazarus Group is back again You're never going to believe this, but Lazarus Group is back again North Korea's infamous APT group is back on the scene, this time with two new remote access trojans. By now, you've probably heard of Lazarus Group and all the annoying things they do to steal sensitive information, make money for North Korea's missile program, etc. But we have an update on their current tactics and payloads they're sending around the globe. Asheer Malhotra from Talos Outreach joins Talos Takes this week to discuss the two new RATs he and his team discovered, why Lazarus Group is still creating new tools, and how their use of older, open-source software has made tracking them ever-so-slightly easier. 

]]> North Korea's infamous APT group is back on the scene, this time with two new remote access trojans. By now, you've probably heard of Lazarus Group and all the annoying things they do to steal sensitive information, make money for North Korea's missile program, etc. But we have an update on their current tactics and payloads they're sending around the globe. Asheer Malhotra from Talos Outreach joins Talos Takes this week to discuss the two new RATs he and his team discovered, why Lazarus Group is still creating new tools, and how their use of older, open-source software has made tracking them ever-so-slightly easier. 

]]> Cisco Talos Buzzsprout-13457070 Fri, 01 Sep 2023 04:00:00 -0400 593 153 full false Carrying out incident response in-person vs. virtually Carrying out incident response in-person vs. virtually Everything about the modern workplace is different now from the start of the COVID-19 pandemic. Many companies are embracing the remote work lifestyle, while others are stuck in a hybrid model or pushing employees to come back to the office. With that in mind, we felt like it was a good time to check in on the incident response process for companies who have to deal with working remotely and those who prefer to conduct business in person. Yuri Kramarz and Gergana Karadzhova-Dangela from Cisco Talos Incident Response join the show this week to discuss how they handle onsite incident response versus engagements that need to be done remotely. There are drawbacks and benefits of both models, so it's up to the individual customer and specific circumstances to determine how a responder can best approach the event in question.

]]> Everything about the modern workplace is different now from the start of the COVID-19 pandemic. Many companies are embracing the remote work lifestyle, while others are stuck in a hybrid model or pushing employees to come back to the office. With that in mind, we felt like it was a good time to check in on the incident response process for companies who have to deal with working remotely and those who prefer to conduct business in person. Yuri Kramarz and Gergana Karadzhova-Dangela from Cisco Talos Incident Response join the show this week to discuss how they handle onsite incident response versus engagements that need to be done remotely. There are drawbacks and benefits of both models, so it's up to the individual customer and specific circumstances to determine how a responder can best approach the event in question.

]]> Cisco Talos Buzzsprout-13452101 Fri, 25 Aug 2023 04:00:00 -0400 931 152 full false Hacktivism is quietly growing, especially when it comes to Russia's invasion of Ukraine Hacktivism is quietly growing, especially when it comes to Russia's invasion of Ukraine The stereotypical "hacker" who looks to do good in the world probably involves a Guy Fawkes mask and black hoodie. But hacktivism has become much more than that, especially since Russia invaded Ukraine. On the heels of a newly released overview on hacktivism, Lexi DiScola from the Talos Threat Intelligence and Interdiction team joins Talos Takes this week to discuss these actors. While not just anyone is likely a target for hacktivists, Talos has seen groups become more brazen and start looking to make money off their operations. 

]]> The stereotypical "hacker" who looks to do good in the world probably involves a Guy Fawkes mask and black hoodie. But hacktivism has become much more than that, especially since Russia invaded Ukraine. On the heels of a newly released overview on hacktivism, Lexi DiScola from the Talos Threat Intelligence and Interdiction team joins Talos Takes this week to discuss these actors. While not just anyone is likely a target for hacktivists, Talos has seen groups become more brazen and start looking to make money off their operations. 

]]> Cisco Talos Buzzsprout-13424149 Fri, 18 Aug 2023 04:00:00 -0400 658 151 full false What's the difference between data theft extortion and ransomware? What's the difference between data theft extortion and ransomware? Cisco Talos Incident Response observed data theft extortion more than any other type of cyber attack last quarter. So why has it become so popular? And what makes it different from ransomware? Jacob Finn from the Talos Threat Intelligence and Interdiction Team joins Jon this week to discuss the basics of data theft extortion. He just worked on an overview of this threat for Talos researchers and works closely with Talos IR on their quarterly trends reports. Jacob discusses why threat actors are choosing data theft extortion over ransomware and how this makes defense and detection more difficult. For more on this topic, read our one-page overview here.

]]> Cisco Talos Incident Response observed data theft extortion more than any other type of cyber attack last quarter. So why has it become so popular? And what makes it different from ransomware? Jacob Finn from the Talos Threat Intelligence and Interdiction Team joins Jon this week to discuss the basics of data theft extortion. He just worked on an overview of this threat for Talos researchers and works closely with Talos IR on their quarterly trends reports. Jacob discusses why threat actors are choosing data theft extortion over ransomware and how this makes defense and detection more difficult. For more on this topic, read our one-page overview here.

]]> Cisco Talos Buzzsprout-13383540 Fri, 11 Aug 2023 04:00:00 -0400 658 150 full false Reading 2023's cybersecurity tarot cards Reading 2023's cybersecurity tarot cards Hazel Burton and Jon Munshaw use this week to look back on the top threats and cybersecurity trends so far in 2023 and the rest of the year. Hazel recently compiled Talos' Half-Year in Review, recapping the top stories that Talos has been following so far this year. She and Jon talk about what stood out from the report, what our researchers have been thinking about up to this point, and what we'll be discussing come December. 

]]> Hazel Burton and Jon Munshaw use this week to look back on the top threats and cybersecurity trends so far in 2023 and the rest of the year. Hazel recently compiled Talos' Half-Year in Review, recapping the top stories that Talos has been following so far this year. She and Jon talk about what stood out from the report, what our researchers have been thinking about up to this point, and what we'll be discussing come December. 

]]> Cisco Talos Buzzsprout-13344874 Fri, 04 Aug 2023 04:00:00 -0400 662 149 full false (XL Edition): The top trends that Talos IR saw last quarter (XL Edition): The top trends that Talos IR saw last quarter We're back with the audio version of our quarterly Cisco Talos Incident Response On Air stream. Join the Talos IR team as they recap the past quarter's top trends, including talking about malware they're seeing in the wild, tactics that attackers are using most often to break into networks, and much more. They discuss why healthcare continues to be a popular target for bad actors, and how adversaries are pivoting away from ransomware and instead opting for data theft and extortion. If you prefer a video version, watch it over on YouTube here.

]]> We're back with the audio version of our quarterly Cisco Talos Incident Response On Air stream. Join the Talos IR team as they recap the past quarter's top trends, including talking about malware they're seeing in the wild, tactics that attackers are using most often to break into networks, and much more. They discuss why healthcare continues to be a popular target for bad actors, and how adversaries are pivoting away from ransomware and instead opting for data theft and extortion. If you prefer a video version, watch it over on YouTube here.

]]> Cisco Talos Buzzsprout-13301877 Fri, 28 Jul 2023 04:00:00 -0400 1786 148 full false ISO 27002 sounds intimidating, but really it's just a cybersecurity shopping list ISO 27002 sounds intimidating, but really it's just a cybersecurity shopping list When Martin Lee first told Jon about ISO 27001 and 27002, Jon had to immediately Google whatever this combination of letters and numbers meant. Turns out there are international standards for cybersecurity, just like they have for selling lightbulbs and installing electrical outlets — who knew? Martin recently wrote about these standards for the Talos blog, outlining a list of recommendations for any organization looking to build a threat intelligence program from the ground up. Jon interviewed him about what these standards are, exactly, what they mean for companies looking to implement these standards, and why they recently included threat intelligence. 

]]> When Martin Lee first told Jon about ISO 27001 and 27002, Jon had to immediately Google whatever this combination of letters and numbers meant. Turns out there are international standards for cybersecurity, just like they have for selling lightbulbs and installing electrical outlets — who knew? Martin recently wrote about these standards for the Talos blog, outlining a list of recommendations for any organization looking to build a threat intelligence program from the ground up. Jon interviewed him about what these standards are, exactly, what they mean for companies looking to implement these standards, and why they recently included threat intelligence. 

]]> Cisco Talos Buzzsprout-13259030 Fri, 21 Jul 2023 04:00:00 -0400 727 147 full false The dangers of "Mercenary" groups and the spyware they create The dangers of "Mercenary" groups and the spyware they create Asheer Malhotra is back to talk to Jon Munshaw about spyware and mercenary groups. Asheer recently helped publish Talos research on Mercenary Groups and why they're so dangerous in particular. We briefly touched on this topic in a past episode on the Predator/Alien spyware tag team, but this time we're getting into the broader field of what Mercenary groups are, exactly, and what makes them so dangerous. Asheer talks about recent steps governments have taken to curb the sale of spyware and why the "average" user should care about this topic, even though they're unlikely to ever be a target. 

]]> Asheer Malhotra is back to talk to Jon Munshaw about spyware and mercenary groups. Asheer recently helped publish Talos research on Mercenary Groups and why they're so dangerous in particular. We briefly touched on this topic in a past episode on the Predator/Alien spyware tag team, but this time we're getting into the broader field of what Mercenary groups are, exactly, and what makes them so dangerous. Asheer talks about recent steps governments have taken to curb the sale of spyware and why the "average" user should care about this topic, even though they're unlikely to ever be a target. 

]]> Cisco Talos Buzzsprout-13219101 Fri, 14 Jul 2023 04:00:00 -0400 508 146 full false The various ways attackers can mess with URLs, TLDs and DNS The various ways attackers can mess with URLs, TLDs and DNS We decided to have a web navigation extravaganza this week! Guilherme Venere and Jaeson Schultz from Talos Outreach have both long been researching the ways in which bad actors try to damage users' inherent trust in the internet. Most internet users interact with the web by typing in a URL or domain name into their web browser (i.e., google.com) expecting that will take them to the right place. But attackers have found various ways to mess with that series of handshakes that must take place. Guilherme and Jaeson talk to Jon about their past years of research into typosquatting domains, new TLDs that open up the door to data leaks, DNS manipulation and more.

Additional reading:

]]> We decided to have a web navigation extravaganza this week! Guilherme Venere and Jaeson Schultz from Talos Outreach have both long been researching the ways in which bad actors try to damage users' inherent trust in the internet. Most internet users interact with the web by typing in a URL or domain name into their web browser (i.e., google.com) expecting that will take them to the right place. But attackers have found various ways to mess with that series of handshakes that must take place. Guilherme and Jaeson talk to Jon about their past years of research into typosquatting domains, new TLDs that open up the door to data leaks, DNS manipulation and more.

Additional reading:

]]> Cisco Talos Buzzsprout-13133867 Fri, 30 Jun 2023 04:00:00 -0400 822 145 full false What we know so far about the MOVEit zero-day making the rounds What we know so far about the MOVEit zero-day making the rounds Aliza Johnson from Talos Threat Intelligence and Interdiction team joins Jon Munshaw this week for a Talos Takes episode on the MOVEit zero-day vulnerability (that's since been patched) making headlines recently. Talos published an advisory last week on everything we know so far about the exploitation of this vulnerability and the group behind it, Clop. Aliza discusses where things stand right now, what Clop is doing once they gain access via this vulnerability and what Talos recommends for mitigation strategies for potentially affected customers. 

]]> Aliza Johnson from Talos Threat Intelligence and Interdiction team joins Jon Munshaw this week for a Talos Takes episode on the MOVEit zero-day vulnerability (that's since been patched) making headlines recently. Talos published an advisory last week on everything we know so far about the exploitation of this vulnerability and the group behind it, Clop. Aliza discusses where things stand right now, what Clop is doing once they gain access via this vulnerability and what Talos recommends for mitigation strategies for potentially affected customers. 

]]> Cisco Talos Buzzsprout-13090135 Fri, 23 Jun 2023 04:00:00 -0400 386 144 full false The hidden threat to the software supply chain you may not be thinking about The hidden threat to the software supply chain you may not be thinking about Cisco Talos Incident Response recently discovered an uptick in malicious actors compromising vendor and third-party accounts to sneak into targeted networks. Many enterprises have vendor and contractor accounts that need to access their network for a variety of things — IT support, cybersecurity, etc. — but these accounts are often monitored less than those belonging to full-time employees. Craig Jackson, who recently co-authored a blog post on this threat, joins Talos Takes this week to talk about vendor and contractor account (VCA) takeover and how they fit into the broader threat of supply chain attacks. 

]]> Cisco Talos Incident Response recently discovered an uptick in malicious actors compromising vendor and third-party accounts to sneak into targeted networks. Many enterprises have vendor and contractor accounts that need to access their network for a variety of things — IT support, cybersecurity, etc. — but these accounts are often monitored less than those belonging to full-time employees. Craig Jackson, who recently co-authored a blog post on this threat, joins Talos Takes this week to talk about vendor and contractor account (VCA) takeover and how they fit into the broader threat of supply chain attacks. 

]]> Cisco Talos Buzzsprout-13046929 Fri, 16 Jun 2023 04:00:00 -0400 720 143 full false Horabot is here to do "horable" things to your email inbox Horabot is here to do "horable" things to your email inbox We're joined this week by Chetan Raghuprasad to discuss a new botnet he recently discovered and researched. Horabot can completely hijack a target's Outlook mailbox to steal their contact list and then send even more spam to targets. It's the perfect business email compromise tool for attackers that comes with a side of banking trojan. Chetan talks to Jon about this malware family's abilities, where it came from and what the actors behind it are hoping to achieve. For more, read Chetan's full blog post.

]]> We're joined this week by Chetan Raghuprasad to discuss a new botnet he recently discovered and researched. Horabot can completely hijack a target's Outlook mailbox to steal their contact list and then send even more spam to targets. It's the perfect business email compromise tool for attackers that comes with a side of banking trojan. Chetan talks to Jon about this malware family's abilities, where it came from and what the actors behind it are hoping to achieve. For more, read Chetan's full blog post.

]]> Cisco Talos Buzzsprout-13004109 Fri, 09 Jun 2023 04:00:00 -0400 816 142 full false The Predator spyware and more "mercenary" groups The Predator spyware and more "mercenary" groups Despite governments' best efforts, spyware is still running rampant on the threat landscape. These types of tracking malware are used to target high-profile individuals like politicians, activists, journalists and more — and even sometimes for jealous exes to track their former partners. Asheer Malhotra, who recently dissected the Predator spyware, joins Talos Takes this week to talk about Predator and its associated tool, Alien. Asheer shares new technical details about this spyware and discusses why "mercenary" spyware groups are on the rise.

If listeners suspect their system(s) may have been compromised by commercial spyware, please consider notifying Talos’ research team at talos-mercenary-spyware-help@external.cisco.com to assist in furthering the community’s knowledge of these threats.

]]> Despite governments' best efforts, spyware is still running rampant on the threat landscape. These types of tracking malware are used to target high-profile individuals like politicians, activists, journalists and more — and even sometimes for jealous exes to track their former partners. Asheer Malhotra, who recently dissected the Predator spyware, joins Talos Takes this week to talk about Predator and its associated tool, Alien. Asheer shares new technical details about this spyware and discusses why "mercenary" spyware groups are on the rise.

If listeners suspect their system(s) may have been compromised by commercial spyware, please consider notifying Talos’ research team at talos-mercenary-spyware-help@external.cisco.com to assist in furthering the community’s knowledge of these threats.

]]> Cisco Talos Buzzsprout-12966276 Fri, 02 Jun 2023 09:00:00 -0400 582 141 full false How to adapt to the constant change that comes with cybersecurity How to adapt to the constant change that comes with cybersecurity Hazel Burton is our special guest host this week of Talos Takes, featuring a very special guest: Talos Vice President Matt Watchinski! Matt and Hazel have a conversation for Mental Health Awareness Month, especially as it relates to the cybersecurity industry. They share tips on how to balance work and life (when it seems like cybersecurity is starting to permeate every aspect of our lives) and how to deal with failure. Join us for this incredibly candid conversation!

]]> Hazel Burton is our special guest host this week of Talos Takes, featuring a very special guest: Talos Vice President Matt Watchinski! Matt and Hazel have a conversation for Mental Health Awareness Month, especially as it relates to the cybersecurity industry. They share tips on how to balance work and life (when it seems like cybersecurity is starting to permeate every aspect of our lives) and how to deal with failure. Join us for this incredibly candid conversation!

]]> Cisco Talos Buzzsprout-12918647 Fri, 26 May 2023 04:00:00 -0400 1104 140 full false RA Group is just the latest example of the ransomware landscape splintering RA Group is just the latest example of the ransomware landscape splintering Talos researchers recently discovered a new ransomware group called "RA Group." This week, Nick Biasni joins Jon to discuss this new threat actor and the modified Babuk ransomware they've already used in attacks against a wide range of companies in the U.S. and South Korea. Nick talks about the group's use of source code that's already been leaked, where they could be headed next and what this group may signal for the larger ransomware landscape.

Other helpful links:

]]> Talos researchers recently discovered a new ransomware group called "RA Group." This week, Nick Biasni joins Jon to discuss this new threat actor and the modified Babuk ransomware they've already used in attacks against a wide range of companies in the U.S. and South Korea. Nick talks about the group's use of source code that's already been leaked, where they could be headed next and what this group may signal for the larger ransomware landscape.

Other helpful links:

]]> Cisco Talos Buzzsprout-12876291 Fri, 19 May 2023 04:00:00 -0400 480 139 full true What makes the new Greatness phishing-as-a-service tool so great? What makes the new Greatness phishing-as-a-service tool so great? Tiago Pereira from Talos Outreach joins the show this week to talk about his recent discovery of a new phishing-as-a-service tool called "Greatness." Since everything else is "as-a-service" nowadays, it's only fitting that attackers have figured out how to monetize easy phishing tools, too. Tiago discusses what makes Greatness unique, why it's going after business targets specifically, and why it creates such convincing fake Office 365 login pages. 

]]> Tiago Pereira from Talos Outreach joins the show this week to talk about his recent discovery of a new phishing-as-a-service tool called "Greatness." Since everything else is "as-a-service" nowadays, it's only fitting that attackers have figured out how to monetize easy phishing tools, too. Tiago discusses what makes Greatness unique, why it's going after business targets specifically, and why it creates such convincing fake Office 365 login pages. 

]]> Cisco Talos Buzzsprout-12829741 Fri, 12 May 2023 04:00:00 -0400 480 138 full false XL Edition: Talos Incident Response livestream on top trends from the past quarter XL Edition: Talos Incident Response livestream on top trends from the past quarter This week's episode is longer than usual, but we wanted to bring you the Cisco Talos Incident Response On Air livestream from last week for anyone who missed it. For anyone who prefers a video version, you can watch the recording here.

In this discussion, researchers from Talos IR and the Talos Threat Intelligence and Interdiction team cover the top threats and attacker tactics they saw over the past quarter. They talk about why the use of web shells is way up, whether or not the ransomware decline is real and how multi-factor authentication could have stopped many of the threats they worked on in the first quarter of 2023. For more, read the latest Talos IR Quarterly Trends report. 

]]> This week's episode is longer than usual, but we wanted to bring you the Cisco Talos Incident Response On Air livestream from last week for anyone who missed it. For anyone who prefers a video version, you can watch the recording here.

In this discussion, researchers from Talos IR and the Talos Threat Intelligence and Interdiction team cover the top threats and attacker tactics they saw over the past quarter. They talk about why the use of web shells is way up, whether or not the ransomware decline is real and how multi-factor authentication could have stopped many of the threats they worked on in the first quarter of 2023. For more, read the latest Talos IR Quarterly Trends report. 

]]> Cisco Talos Buzzsprout-12784675 Fri, 05 May 2023 04:00:00 -0400 1962 137 full false Analyzing the recent takedown of popular dark web forums Analyzing the recent takedown of popular dark web forums On the heels of law enforcement agencies from across the globe working together to disrupt two popular cybercrime forums — Genesis Market and BreachForums — Azim Khodjibaev from Talos' Threat Intelligence & Interdiction team joins Jon to talk about these types of sites. Azim has years of experience infiltrating and investigating these types of marketplaces to learn about emerging security threats. He talks about what goes into these types of takedowns and where the sites' users are likely to go from here.

Suggested reading:

]]> On the heels of law enforcement agencies from across the globe working together to disrupt two popular cybercrime forums — Genesis Market and BreachForums — Azim Khodjibaev from Talos' Threat Intelligence & Interdiction team joins Jon to talk about these types of sites. Azim has years of experience infiltrating and investigating these types of marketplaces to learn about emerging security threats. He talks about what goes into these types of takedowns and where the sites' users are likely to go from here.

Suggested reading:

]]> Cisco Talos Buzzsprout-12721139 Fri, 28 Apr 2023 04:00:00 -0400 536 136 full false What does the future of MFA look like? What does the future of MFA look like? Nowadays it seems like every major tech company has their own multi-factor authentication solution, whether that be a unique app, one-time passcode generation or the "classic" SMS two-factor code. Thorsten Rosendahl, the newest addition to the Cisco Talos Strategic Communications team in Europe, joins the show this week to discuss the conversations he's been having with customers in the field around MFA. He and Jon cover the news that Twitter is going to start charging for users to enroll in SMS-based MFA, the challenge of having too many authenticator apps on their personal devices and how we can get closer to a passwordless future.

Other suggested reading:

]]> Nowadays it seems like every major tech company has their own multi-factor authentication solution, whether that be a unique app, one-time passcode generation or the "classic" SMS two-factor code. Thorsten Rosendahl, the newest addition to the Cisco Talos Strategic Communications team in Europe, joins the show this week to discuss the conversations he's been having with customers in the field around MFA. He and Jon cover the news that Twitter is going to start charging for users to enroll in SMS-based MFA, the challenge of having too many authenticator apps on their personal devices and how we can get closer to a passwordless future.

Other suggested reading:

]]> Cisco Talos Buzzsprout-12695720 Fri, 21 Apr 2023 09:00:00 -0400 750 135 full false How to best prepare for, and respond to, supply chain attacks How to best prepare for, and respond to, supply chain attacks With another major supply chain attack recently making headlines, we felt like it was a good time to refresh our advice on how to prepare for these types of cyber attacks. Adversaries are increasingly relying on users' inherent trust of the software running on their networks and devices to deliver hijacked, malicious updates that are actually malware. Craig Jackson, a senior Cisco Talos incident responder, joins the show to provide some advice on how organizations can prep for the next major supply chain attack. We also discuss the current, ongoing 3CX situation and how anyone potentially affected could respond now.

Other suggested reading:

]]> With another major supply chain attack recently making headlines, we felt like it was a good time to refresh our advice on how to prepare for these types of cyber attacks. Adversaries are increasingly relying on users' inherent trust of the software running on their networks and devices to deliver hijacked, malicious updates that are actually malware. Craig Jackson, a senior Cisco Talos incident responder, joins the show to provide some advice on how organizations can prep for the next major supply chain attack. We also discuss the current, ongoing 3CX situation and how anyone potentially affected could respond now.

Other suggested reading:

]]> Cisco Talos Buzzsprout-12649912 Fri, 14 Apr 2023 09:00:00 -0400 573 134 full false The defensive and offensive implications of ChatGPT and AI The defensive and offensive implications of ChatGPT and AI Everyone is talking about tools like ChatGPT and other AI tools that are dominating headlines and threatening to upend every industry possible. But where do these things stand in cybersecurity? In this week's episode, Jon talks to two women who are well-versed on the topic and recently presented about the cybersecurity implications of AI at several conferences. Gergana Karadzhova of Cisco Talos Incident Response and Saskia Laura Schroer, a security consulting engineer for Cisco, discuss how AI is currently influencing attackers and defenders. Are attackers already using these tools? Does it give them superpowers? And what questions are still left unanswered about this emerging technology? 

]]> Everyone is talking about tools like ChatGPT and other AI tools that are dominating headlines and threatening to upend every industry possible. But where do these things stand in cybersecurity? In this week's episode, Jon talks to two women who are well-versed on the topic and recently presented about the cybersecurity implications of AI at several conferences. Gergana Karadzhova of Cisco Talos Incident Response and Saskia Laura Schroer, a security consulting engineer for Cisco, discuss how AI is currently influencing attackers and defenders. Are attackers already using these tools? Does it give them superpowers? And what questions are still left unanswered about this emerging technology? 

]]> Cisco Talos Buzzsprout-12550520 Fri, 31 Mar 2023 04:00:00 -0400 858 133 full false Talos Takes Ep. #132: Reflecting on one year of Talos' work in Ukraine Talos Takes Ep. #132: Reflecting on one year of Talos' work in Ukraine It's been just over a year since Talos formed our Ukraine-focused task force. After Russia's invasion of Ukraine, many of our teammates sprung into action to protect critical infrastructure and networks there — not to mention the Talos employees who literally had to fight back to protect their home country. In this week's episode of Talos Takes, J.J. Cummings, one of the lead organizers of this task force, joins the show to discuss the group's ongoing work. J.J. talks about where the situation in Ukraine stands currently, how the cyber threats facing the country have evolved over the past year and much more. To further mark the one-year anniversary of the conflict, Talos has also released a graphic novel illustrating the formation of this task force. Additionally, the latest episode of ThreatWise TV from Cisco highlights the work Talos and Cisco are doing in Ukraine. 

]]> It's been just over a year since Talos formed our Ukraine-focused task force. After Russia's invasion of Ukraine, many of our teammates sprung into action to protect critical infrastructure and networks there — not to mention the Talos employees who literally had to fight back to protect their home country. In this week's episode of Talos Takes, J.J. Cummings, one of the lead organizers of this task force, joins the show to discuss the group's ongoing work. J.J. talks about where the situation in Ukraine stands currently, how the cyber threats facing the country have evolved over the past year and much more. To further mark the one-year anniversary of the conflict, Talos has also released a graphic novel illustrating the formation of this task force. Additionally, the latest episode of ThreatWise TV from Cisco highlights the work Talos and Cisco are doing in Ukraine. 

]]> Cisco Talos Buzzsprout-12502298 Fri, 24 Mar 2023 04:00:00 -0400 720 132 full false Why does the Prometei botnet keep growing? Why does the Prometei botnet keep growing? Vanja Svajcer and Andrew Windsor join the show this week to talk about their recent research into the Prometei botnet. This malware continues to evade detection and invade more machines so it can eventually hijack them to mine Monero cryptocurrency. Jon asks them about what's new with Prometei, why it's pretty generous in who it's targeting and where we could see it going next.

Additional reading

]]> Vanja Svajcer and Andrew Windsor join the show this week to talk about their recent research into the Prometei botnet. This malware continues to evade detection and invade more machines so it can eventually hijack them to mine Monero cryptocurrency. Jon asks them about what's new with Prometei, why it's pretty generous in who it's targeting and where we could see it going next.

Additional reading

]]> Cisco Talos Buzzsprout-12460134 Fri, 17 Mar 2023 10:00:00 -0400 720 131 full false There's not actually more spam during Tax Season — it's just different spam There's not actually more spam during Tax Season — it's just different spam Public perception is such that it's assumed we just get more spam in the U.S. during two major times of the year — Tax Season and Black Friday. But over the past few years, this trend has become a thing of the past. With Tax Day approaching for Americans, there won't be more spam emails coming their way than usual, it'll just be different. Eric Peterson from Talos' email detection team joins the show for Jon's triumphant return from parental leave to talk about tax-related spam. Eric talks about topics he's seen so far this year and why it's a myth that spam volume changes as Tax Day approaches. 

]]> Public perception is such that it's assumed we just get more spam in the U.S. during two major times of the year — Tax Season and Black Friday. But over the past few years, this trend has become a thing of the past. With Tax Day approaching for Americans, there won't be more spam emails coming their way than usual, it'll just be different. Eric Peterson from Talos' email detection team joins the show for Jon's triumphant return from parental leave to talk about tax-related spam. Eric talks about topics he's seen so far this year and why it's a myth that spam volume changes as Tax Day approaches. 

]]> Cisco Talos Buzzsprout-12413790 Fri, 10 Mar 2023 09:00:00 -0500 603 130 full false The benefits of taking an active approach to threat defense The benefits of taking an active approach to threat defense Nick Biasini is back as host again to talk to Vitor Ventura about the benefits of taking an active approach to threat defense. Many organizations may just sit back and wait for something bad to happen. But as he outlined in his recent blog post, Vitor says there are many benefits to being proactive instead of reactive. Nick asks him about threat hunting as a team, scanning logs and tracking network traffic on an almost-constant basis. 

]]> Nick Biasini is back as host again to talk to Vitor Ventura about the benefits of taking an active approach to threat defense. Many organizations may just sit back and wait for something bad to happen. But as he outlined in his recent blog post, Vitor says there are many benefits to being proactive instead of reactive. Nick asks him about threat hunting as a team, scanning logs and tracking network traffic on an almost-constant basis. 

]]> Cisco Talos Buzzsprout-12367602 Fri, 03 Mar 2023 09:00:00 -0500 637 129 full false Year in Review - Ransomware and Commodity Loaders Year in Review - Ransomware and Commodity Loaders We're back with the final year in review focused episode. This time the focus is on the ever broadening ransomware landscape and the commodity malware loaders that often support it. I'll be joined by one of the researchers from the year in review report, Aliza Johnson to talk about what we saw on the ransomware landscape over the last year as well as how threats like Qakbot, IcedID, and Trickbot have changed and evolved over the last year. We'll also cover how these threats overlap and how LoLBins are yet again an area of concern. 

]]> We're back with the final year in review focused episode. This time the focus is on the ever broadening ransomware landscape and the commodity malware loaders that often support it. I'll be joined by one of the researchers from the year in review report, Aliza Johnson to talk about what we saw on the ransomware landscape over the last year as well as how threats like Qakbot, IcedID, and Trickbot have changed and evolved over the last year. We'll also cover how these threats overlap and how LoLBins are yet again an area of concern. 

]]> Cisco Talos Buzzsprout-12218183 Fri, 10 Feb 2023 10:00:00 -0500 675 128 full false Following the LNK metadata trail Following the LNK metadata trail In this episode of Talos Takes I am joined by security researcher Guilherme Venere to discuss their recent research on LNK files. The usage of these files by malicious actors has exploded over the last six months as actors look to move away from macro based initial infection vectors. LNK files do have unique metadata attributes to allows for useful actor and threat tracking capabilities. We'll dig deeper on LNK files as well as the metadata you can leverage. For full details check out the blog at https://blog.talosintelligence.com/following-the-lnk-metadata-trail/

]]> In this episode of Talos Takes I am joined by security researcher Guilherme Venere to discuss their recent research on LNK files. The usage of these files by malicious actors has exploded over the last six months as actors look to move away from macro based initial infection vectors. LNK files do have unique metadata attributes to allows for useful actor and threat tracking capabilities. We'll dig deeper on LNK files as well as the metadata you can leverage. For full details check out the blog at https://blog.talosintelligence.com/following-the-lnk-metadata-trail/

]]> Cisco Talos Buzzsprout-12130685 Fri, 03 Feb 2023 10:00:00 -0500 698 127 full false Year in Review - Threat Landscape Edition Year in Review - Threat Landscape Edition We're back with another year in review focused episode. This time the focus will be the threat landscape generally and I'll be joined by threat researcher Caitlin Huey. In this episode we'll discuss what we found in the last year, with a focus on the general threat landscape.  We'll spend time discussing dual use tools, lolbins, and the surprising re-emergence of USB attacks in 2022. 

]]> We're back with another year in review focused episode. This time the focus will be the threat landscape generally and I'll be joined by threat researcher Caitlin Huey. In this episode we'll discuss what we found in the last year, with a focus on the general threat landscape.  We'll spend time discussing dual use tools, lolbins, and the surprising re-emergence of USB attacks in 2022. 

]]> Cisco Talos Buzzsprout-12109205 Fri, 27 Jan 2023 10:00:00 -0500 434 126 full false XLLing and the post macro era XLLing and the post macro era In this episode of Talos Takes we are joined by Vanja Svjacer to discuss his recent blog on XLL abuse. This year Microsoft finally removed support for macros from their office suite creating a vacuum in the threat landscape. Macros had been the tool of choice for adversaries for the last several years and the race to find alternatives is underway. In this episode we'll talk a bit about Office Add-Ins and how we've already seen adversaries starting to abuse XLL files in the wild.

]]> In this episode of Talos Takes we are joined by Vanja Svjacer to discuss his recent blog on XLL abuse. This year Microsoft finally removed support for macros from their office suite creating a vacuum in the threat landscape. Macros had been the tool of choice for adversaries for the last several years and the race to find alternatives is underway. In this episode we'll talk a bit about Office Add-Ins and how we've already seen adversaries starting to abuse XLL files in the wild.

]]> Cisco Talos Buzzsprout-12068797 Fri, 20 Jan 2023 10:00:00 -0500 561 125 full false Year in Review: APT Summary Edition Year in Review: APT Summary Edition In this episode of Talos Takes we are joined by Jacob Finn to discuss the APT summary section of the larger year in review report. These state sponsored actors tend to conduct more sophisticated, targeted campaigns typically related to espionage or other information gathering activities. This episode will dive a bit deeper on what can be found in the report as well as an overview of the state sponsored activity we've observed from the last year.

]]> In this episode of Talos Takes we are joined by Jacob Finn to discuss the APT summary section of the larger year in review report. These state sponsored actors tend to conduct more sophisticated, targeted campaigns typically related to espionage or other information gathering activities. This episode will dive a bit deeper on what can be found in the report as well as an overview of the state sponsored activity we've observed from the last year.

]]> Cisco Talos Buzzsprout-12016411 Fri, 13 Jan 2023 10:00:00 -0500 796 124 full false Truebot and the Silence group Truebot and the Silence group In this episode of Talos Takes we are joined by Tiago Periera to discuss his recent blog on truebot activity. Truebot and the silence group have been active for a number of years operating primarily financially motivated cybercrime. In this episode we will talk about the recent campaign we observed as well as the tools and tactics we uncovered. We'll also discuss the links between these groups and other threat actors, like TA505.

]]> In this episode of Talos Takes we are joined by Tiago Periera to discuss his recent blog on truebot activity. Truebot and the silence group have been active for a number of years operating primarily financially motivated cybercrime. In this episode we will talk about the recent campaign we observed as well as the tools and tactics we uncovered. We'll also discuss the links between these groups and other threat actors, like TA505.

]]> Cisco Talos Buzzsprout-11977748 Fri, 06 Jan 2023 10:00:00 -0500 668 123 full false Year in Review & Ukraine Activities Year in Review & Ukraine Activities In this episode of Talos Takes we are joined by Kendall McKay to discuss the recently released year in review report and dig deep on our activities in Ukraine. The year in review covers a vast amount of data and intel sources to identify some of the key trends we observed in 2022. Our activities in Ukraine have been well documented, in this episode we'll also talk more broadly about the trends and highlight some key findings from the past year.

]]> In this episode of Talos Takes we are joined by Kendall McKay to discuss the recently released year in review report and dig deep on our activities in Ukraine. The year in review covers a vast amount of data and intel sources to identify some of the key trends we observed in 2022. Our activities in Ukraine have been well documented, in this episode we'll also talk more broadly about the trends and highlight some key findings from the past year.

]]> Cisco Talos Buzzsprout-11871810 Fri, 16 Dec 2022 10:00:00 -0500 596 122 full false Update on LodaRAT and its many variants Update on LodaRAT and its many variants LodaRAT is an AutoIT based RAT that has been distributed for the last several years. Initially tied to the Kasablanka group its distribution has grown over the years. In this episode we'll be talking with the researcher, Chris Neal, to discuss LodaRAT, the campaigns we've been observing along with some key tidbits about how AutoIT is abused by adversaries. Including some fun with decompiling and recompling.

]]> LodaRAT is an AutoIT based RAT that has been distributed for the last several years. Initially tied to the Kasablanka group its distribution has grown over the years. In this episode we'll be talking with the researcher, Chris Neal, to discuss LodaRAT, the campaigns we've been observing along with some key tidbits about how AutoIT is abused by adversaries. Including some fun with decompiling and recompling.

]]> Cisco Talos Buzzsprout-11788099 Fri, 02 Dec 2022 10:00:00 -0500 513 121 full false The basics of InterPlanetary File System (IPFS) and how its being abused The basics of InterPlanetary File System (IPFS) and how its being abused InterPlanetary File System or IPFS has increased in prominence as a file hosting technology associated with Web 3.0. It's probably most well known for hosting NFTs, but this blockchain related technology is also being abused by bad actors. In this episode we'll be talking with Edmund Brumaghin about his recent research into IPFS and his findings. We'll also talk about the ways we've seen malicious actors abuse it and briefly touch on things organizations can do to protect themselves.

]]> InterPlanetary File System or IPFS has increased in prominence as a file hosting technology associated with Web 3.0. It's probably most well known for hosting NFTs, but this blockchain related technology is also being abused by bad actors. In this episode we'll be talking with Edmund Brumaghin about his recent research into IPFS and his findings. We'll also talk about the ways we've seen malicious actors abuse it and briefly touch on things organizations can do to protect themselves.

]]> Cisco Talos Buzzsprout-11707400 Fri, 18 Nov 2022 10:00:00 -0500 473 120 full false The best (and free) ways to improve your cybersecurity skills The best (and free) ways to improve your cybersecurity skills To wrap up Cybersecurity Awareness Month, we're looking at the best, and free, ways to improve your security skills. Jason Kirkland and David Roman from Cisco Talos Incident Response join Jon to talk about the websites, YouTube channels, social media profiles and more they use to stay up-to-date on security news and polish their cybersecurity skills. 

Here are links to some of the resources we spoke about in this episode:

]]> To wrap up Cybersecurity Awareness Month, we're looking at the best, and free, ways to improve your security skills. Jason Kirkland and David Roman from Cisco Talos Incident Response join Jon to talk about the websites, YouTube channels, social media profiles and more they use to stay up-to-date on security news and polish their cybersecurity skills. 

Here are links to some of the resources we spoke about in this episode:

]]> Buzzsprout-11586703 Fri, 28 Oct 2022 10:00:00 -0400 732 119 full false The basics of threat hunting The basics of threat hunting To celebrate this week's National Cybersecurity Awareness Month theme, we have a special 101 episode of Talos Takes to cover the basics of threat hunting. This is a crucial skill for any cybersecurity professional-in-training and one of the questions we get the most often. Asheer Malhotra from the Talos Outreach team joins the show to talk about where he starts finding new malware families and threat actors, what the barriers usually are that he has to overcome and what check boxes he has to hit before he can talk about something publicly. For more on this topic, watch our "Threat Hunting 101" livestream from earlier this week here. 

]]> To celebrate this week's National Cybersecurity Awareness Month theme, we have a special 101 episode of Talos Takes to cover the basics of threat hunting. This is a crucial skill for any cybersecurity professional-in-training and one of the questions we get the most often. Asheer Malhotra from the Talos Outreach team joins the show to talk about where he starts finding new malware families and threat actors, what the barriers usually are that he has to overcome and what check boxes he has to hit before he can talk about something publicly. For more on this topic, watch our "Threat Hunting 101" livestream from earlier this week here. 

]]> Cisco Talos Buzzsprout-11542593 Fri, 21 Oct 2022 10:00:00 -0400 615 118 full false Tips for kickstarting your cybersecurity career Tips for kickstarting your cybersecurity career To celebrate National Cybersecurity Awareness Month, two one-time "security noobs" talk about their career trajectories and how they've grown to see themselves in cyber. Sammi Seaman and Jon Munshaw talk about their previous careers in library services and journalism, respectively, and how they applied some of those skills to cybersecurity. Other talking points include:

  • Cybersecurity "ah ha!" moments.
  • Not being afraid to ask questions.
  • Free ways to expand one's cybersecurity knowledge.
  • The importance of getting involved in local cybersecurity conferences and non-profits.
]]> To celebrate National Cybersecurity Awareness Month, two one-time "security noobs" talk about their career trajectories and how they've grown to see themselves in cyber. Sammi Seaman and Jon Munshaw talk about their previous careers in library services and journalism, respectively, and how they applied some of those skills to cybersecurity. Other talking points include:

  • Cybersecurity "ah ha!" moments.
  • Not being afraid to ask questions.
  • Free ways to expand one's cybersecurity knowledge.
  • The importance of getting involved in local cybersecurity conferences and non-profits.
]]> Cisco Talos Buzzsprout-11500209 Fri, 14 Oct 2022 10:00:00 -0400 859 117 full false The latest on Lockbit 3.0 drama and the rest of the ransomware landscape The latest on Lockbit 3.0 drama and the rest of the ransomware landscape Azim Khodjibaev joins the show once again for the latest addition of "Days of our Ransomware." Jon and Azim talk about the recent LockBit 3.0 leaks and the drama surrounding them. Will other actors try to backpack off the leaked builder? Why is LockBit switching to triple extortion tactics now? And what other trends are going on in the ransomware landscape? This is the perfect place to get caught up on all things ransomware to head into the rest of National Cybersecurity Awareness Month. 

]]> Azim Khodjibaev joins the show once again for the latest addition of "Days of our Ransomware." Jon and Azim talk about the recent LockBit 3.0 leaks and the drama surrounding them. Will other actors try to backpack off the leaked builder? Why is LockBit switching to triple extortion tactics now? And what other trends are going on in the ransomware landscape? This is the perfect place to get caught up on all things ransomware to head into the rest of National Cybersecurity Awareness Month. 

]]> Cisco Talos Buzzsprout-11457844 Fri, 07 Oct 2022 11:00:00 -0400 566 116 full false An "insider threat" doesn't always have to know they're a threat An "insider threat" doesn't always have to know they're a threat Nick Biasini is back on once again to talk to Jon about Insider Threats. Nick recently wrote a post about how he and Cisco Talos Incident Response are seeing an increase in these types of attacks in the wild. And while the term "insider threat" may sound like someone actively seeking to do something bad, that's now always the case. This week's episode discusses how to prepare for Insider Threats and some of the hallmarks of the spam emails, calls and mobile notifications we're seeing in these campaigns. 

]]> Nick Biasini is back on once again to talk to Jon about Insider Threats. Nick recently wrote a post about how he and Cisco Talos Incident Response are seeing an increase in these types of attacks in the wild. And while the term "insider threat" may sound like someone actively seeking to do something bad, that's now always the case. This week's episode discusses how to prepare for Insider Threats and some of the hallmarks of the spam emails, calls and mobile notifications we're seeing in these campaigns. 

]]> Cisco Talos Buzzsprout-11413990 Fri, 30 Sep 2022 10:00:00 -0400 421 115 full false Once more into the Lazarus Pit Once more into the Lazarus Pit Vitor Ventura from the Talos Outreach team joins the show this week to run down Talos' recent research into the Lazarus Group. This well-known North Korean state-sponsored threat actor is well known for their ransomware and cryptocurrency-related cyber attacks, but we recently found them launching a new information-stealing trojan targeting energy companies. Vitor talks about the new trojan, MagicRAT, and how it fits into their larger plans and motivations. 

]]> Vitor Ventura from the Talos Outreach team joins the show this week to run down Talos' recent research into the Lazarus Group. This well-known North Korean state-sponsored threat actor is well known for their ransomware and cryptocurrency-related cyber attacks, but we recently found them launching a new information-stealing trojan targeting energy companies. Vitor talks about the new trojan, MagicRAT, and how it fits into their larger plans and motivations. 

]]> Cisco Talos Buzzsprout-11372621 Fri, 23 Sep 2022 10:00:00 -0400 484 114 full false Digging into Gamaredon's cave and its recent campaign against Ukraine Digging into Gamaredon's cave and its recent campaign against Ukraine Guilherme Venere of the Outreach team joins Jon this week to discuss the Gamaredon APT group. This Russian state-sponsored actor is infamous at this point in its life, but it keeps growing by adding new tools and malware. Recently, Guilherme helped to discover a new campaign targeting users and organizations in Ukraine, a common target of Gamaredon since the onset of Russia's invasion. They discuss what's unique about this particular attack, and why we can't just assume their activities will stay isolated to Ukraine for the time being. 

]]> Guilherme Venere of the Outreach team joins Jon this week to discuss the Gamaredon APT group. This Russian state-sponsored actor is infamous at this point in its life, but it keeps growing by adding new tools and malware. Recently, Guilherme helped to discover a new campaign targeting users and organizations in Ukraine, a common target of Gamaredon since the onset of Russia's invasion. They discuss what's unique about this particular attack, and why we can't just assume their activities will stay isolated to Ukraine for the time being. 

]]> Cisco Talos Buzzsprout-11332516 Fri, 16 Sep 2022 13:00:00 -0400 394 113 full false Back to school advice for teachers, students, parents, admins and everyone in between Back to school advice for teachers, students, parents, admins and everyone in between We're headed back to school with Talos Takes again! Pierre Cadieux from Cisco Talos Incident Response joins the show to talk about advice for educational institutions. Jon asks him about common incident response advice for the education sector and we cover security advice for school admins, parents and students who have to worry about electronic devices traveling to and from school and connecting to all sorts of networks. This episode is particularly relevant this week given some recent major cyber attacks against the education sector, including a major event at the combined Los Angeles school district. 

]]> We're headed back to school with Talos Takes again! Pierre Cadieux from Cisco Talos Incident Response joins the show to talk about advice for educational institutions. Jon asks him about common incident response advice for the education sector and we cover security advice for school admins, parents and students who have to worry about electronic devices traveling to and from school and connecting to all sorts of networks. This episode is particularly relevant this week given some recent major cyber attacks against the education sector, including a major event at the combined Los Angeles school district. 

]]> Cisco Talos Buzzsprout-11283506 Fri, 09 Sep 2022 08:00:00 -0400 736 112 full false XL Edition: Talos' update on our work in Ukraine XL Edition: Talos' update on our work in Ukraine This week, we have the audio version of our recent livestream for Ukraine Independence Day. Talos assembled a panel of experts who have been working hands-on to defend critical Ukraine systems and its citizens from cyber threats. JJ Cummings, Ashlee Benge and Dmytro Krozhevin answer questions from Hazel Burton about the current security threats Ukraine faces, what Talos has done to hunt for threats in the region and how Cisco is supporting its employees in Ukraine.

]]> This week, we have the audio version of our recent livestream for Ukraine Independence Day. Talos assembled a panel of experts who have been working hands-on to defend critical Ukraine systems and its citizens from cyber threats. JJ Cummings, Ashlee Benge and Dmytro Krozhevin answer questions from Hazel Burton about the current security threats Ukraine faces, what Talos has done to hunt for threats in the region and how Cisco is supporting its employees in Ukraine.

]]> Cisco Talos Buzzsprout-11249235 Fri, 02 Sep 2022 09:00:00 -0400 3344 111 full false Talos Takes Ep. #110: The kinetic and cyber threats Ukrainian agriculture faces Talos Takes Ep. #110: The kinetic and cyber threats Ukrainian agriculture faces
  • An underrated aspect of Russia’s invasion of Ukraine is the effect it’s had on the global food supply chain. Ukraine is a major importer and exporter of grain and other food staples, but the industry now faces kinetic and cyber threats. Joe Marshall of Talos has spent months learning all about agricultural cybersecurity and the unique position farming equipment and infrastructure is in. Joe recently wrote about these threats for the Talos blog and joins Talos Takes to talk about how important Ukraine is to the global food supply chain and what law enforcement and global governments can do to prepare for potential state-sponsored attacks.
    • ]]>
  • An underrated aspect of Russia’s invasion of Ukraine is the effect it’s had on the global food supply chain. Ukraine is a major importer and exporter of grain and other food staples, but the industry now faces kinetic and cyber threats. Joe Marshall of Talos has spent months learning all about agricultural cybersecurity and the unique position farming equipment and infrastructure is in. Joe recently wrote about these threats for the Talos blog and joins Talos Takes to talk about how important Ukraine is to the global food supply chain and what law enforcement and global governments can do to prepare for potential state-sponsored attacks.
    • ]]>     Cisco Talos Buzzsprout-11208132 Fri, 26 Aug 2022 09:00:00 -0400 498 110 full false     Talos Takes Ep. #109: Why cybercrime is going small-time Talos Takes Ep. #109: Why cybercrime is going small-time The public traditionally thinks about cyber attacks as being from some well-funded, state-sponsored actor. But increasingly small-time criminals are turning to the internet to make their money. Increasingly, they’re not carrying out one-off robberies, and instead are working on insurance fraud scams and spam emails. Nick Biasini joins Talos Takes this week to discuss his recent research into this topic and shares what the data shows about the growth of small-time cybercrime.

    ]]>     The public traditionally thinks about cyber attacks as being from some well-funded, state-sponsored actor. But increasingly small-time criminals are turning to the internet to make their money. Increasingly, they’re not carrying out one-off robberies, and instead are working on insurance fraud scams and spam emails. Nick Biasini joins Talos Takes this week to discuss his recent research into this topic and shares what the data shows about the growth of small-time cybercrime.

    ]]>     Cisco Talos Buzzsprout-11165673 Fri, 19 Aug 2022 09:00:00 -0400 505 109 full false     Talos Takes Ep. #61: Why does SideCopy seem so familiar? Talos Takes Ep. #61: Why does SideCopy seem so familiar? The last time Jon had Asheer Malhotra from Talos Outreach on the show, they covered the Transparent Tribe APT. Asheer joins the show again this week to talk about another threat actor that is very similar to Transparent Tribe, but is just a tad different. Asheer recently co-authored a research paper on the aptly named SideCopy actor, which borrows many TTPs from their fellow actors, including Transparent Tribe. This episode, we’ll talk about SideCopy’s methods, why they may be borrowing so much from those around them and where they could go from here.

    ]]>     The last time Jon had Asheer Malhotra from Talos Outreach on the show, they covered the Transparent Tribe APT. Asheer joins the show again this week to talk about another threat actor that is very similar to Transparent Tribe, but is just a tad different. Asheer recently co-authored a research paper on the aptly named SideCopy actor, which borrows many TTPs from their fellow actors, including Transparent Tribe. This episode, we’ll talk about SideCopy’s methods, why they may be borrowing so much from those around them and where they could go from here.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/459 Fri, 12 Aug 2022 12:00:00 -0400 508 APTs, SideCopy, RATs, trojans, spam, phishing full false     Talos Takes Ep. #59: A deep dive into vulnerabilities in a home security station Talos Takes Ep. #59: A deep dive into vulnerabilities in a home security station We’ve spent many minutes (that’s the point of the podcast, after all) discussing internet-of-things devices on this podcast. As consumers start having more “smart” devices connected to their home network, they may want an easy solution to keeping those devices safe. But what if that device gets owned?

    Carl Hurd of our vulnerability research team recently discovered several vulnerabilities in Trend Micro’s Home Network Security Station. He joins the show for the first time to talk about his research, the pros and cons of these all-in-one home network security devices, and how an attacker could exploit these issues to spy on your devices.

    ]]>     We’ve spent many minutes (that’s the point of the podcast, after all) discussing internet-of-things devices on this podcast. As consumers start having more “smart” devices connected to their home network, they may want an easy solution to keeping those devices safe. But what if that device gets owned?

    Carl Hurd of our vulnerability research team recently discovered several vulnerabilities in Trend Micro’s Home Network Security Station. He joins the show for the first time to talk about his research, the pros and cons of these all-in-one home network security devices, and how an attacker could exploit these issues to spy on your devices.

    ]]>     Jon Munshaw (host) and Carl Hurd (speaker) https://www.talosintelligence.com/podcasts/457 Fri, 12 Aug 2022 12:00:00 -0400 625 vulnerabilities, IoT, home security full false     Talos Takes Ep. #58: It's time to get serious about protecting critical infrastructure Talos Takes Ep. #58: It's time to get serious about protecting critical infrastructure With major cyber attacks in recent years against major U.S. critical infrastructure suppliers like Norsk Hydro and Colonial Pipeline, we’re in a new world of CI cybersecurity. New threats require new approaches to defense. And in the U.S., this is likely going to include partnerships between those who manage critical infrastructure, government and the private cybersecurity sector.

    Talos recently outlined what this may look like in America. One of the authors of that post, Joe Marshall, joins Jon Munshaw this week on Talos Takes to talk about public-private partnerships to defend critical infrastructure.

    ]]>     With major cyber attacks in recent years against major U.S. critical infrastructure suppliers like Norsk Hydro and Colonial Pipeline, we’re in a new world of CI cybersecurity. New threats require new approaches to defense. And in the U.S., this is likely going to include partnerships between those who manage critical infrastructure, government and the private cybersecurity sector.

    Talos recently outlined what this may look like in America. One of the authors of that post, Joe Marshall, joins Jon Munshaw this week on Talos Takes to talk about public-private partnerships to defend critical infrastructure.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/456 Fri, 12 Aug 2022 12:00:00 -0400 521 critical infrastructure, oil and natural gas, ransomware, operational technology full false     Talos Takes Ep. #57: What's in it for both sides of the ransomware-as-a-service model? Talos Takes Ep. #57: What's in it for both sides of the ransomware-as-a-service model? How much is ransomware-as-a-service like a McDonald’s franchise? More similar than you’d think! The RaaS model has entered the mainstream over the past few months with groups such as DarkSide attacking the Colonial Pipeline.

    In these transactions, what’s in it for the original ransomware creator? And what do the operators themselves get out of it? Nick Biasini joins Jon Munshaw this week to talk about this business model, what it means for the rise in ransomware attacks, and how you can stay protected.

    ]]>     How much is ransomware-as-a-service like a McDonald’s franchise? More similar than you’d think! The RaaS model has entered the mainstream over the past few months with groups such as DarkSide attacking the Colonial Pipeline.

    In these transactions, what’s in it for the original ransomware creator? And what do the operators themselves get out of it? Nick Biasini joins Jon Munshaw this week to talk about this business model, what it means for the rise in ransomware attacks, and how you can stay protected.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/454 Fri, 12 Aug 2022 12:00:00 -0400 327 ransomware, ransomware-as-a-service, OT, critical infrastructure full false     Talos Takes Ep. #62: There's still plenty of mileage left in BEC Talos Takes Ep. #62: There's still plenty of mileage left in BEC Business email compromise may seem like last decade’s threat, but it’s still just as prevalent as ever. A recent FBI report found that it cost users more than $1 billion in 2020, and attackers are now capitalizing on everything from PlayStation 5 sales to the COVID-19 pandemic to still scam people. On this week’s Talos Takes, Nick Biasini recaps his recent research into BEC and discusses why there are some reasons why this threat may never go away (hint: users).

    ]]>     Business email compromise may seem like last decade’s threat, but it’s still just as prevalent as ever. A recent FBI report found that it cost users more than $1 billion in 2020, and attackers are now capitalizing on everything from PlayStation 5 sales to the COVID-19 pandemic to still scam people. On this week’s Talos Takes, Nick Biasini recaps his recent research into BEC and discusses why there are some reasons why this threat may never go away (hint: users).

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/461 Fri, 12 Aug 2022 12:00:00 -0400 325 business email compromise, spam, phishing, email full false     Talos Takes Ep. #56: The first security steps when returning to the office Talos Takes Ep. #56: The first security steps when returning to the office We started out the COVID-19 pandemic by thinking we’d be away from the office for a month — maybe two. More than 12 months later, we’re still here, working from home (at least part-time).

    But some businesses are starting to reopen now and welcoming workers back into the office. After so much time working out of the office, what should security professionals do once they get back? In this week’s episode, Beers with Talos’ own Craig Williams joins the show to talk about triple-checking for patches, changing passwords and more. Plus, how should you handle the new hybrid worker?

    ]]>     We started out the COVID-19 pandemic by thinking we’d be away from the office for a month — maybe two. More than 12 months later, we’re still here, working from home (at least part-time).

    But some businesses are starting to reopen now and welcoming workers back into the office. After so much time working out of the office, what should security professionals do once they get back? In this week’s episode, Beers with Talos’ own Craig Williams joins the show to talk about triple-checking for patches, changing passwords and more. Plus, how should you handle the new hybrid worker?

    ]]>     Jon Munshaw (host) https://www.talosintelligence.com/podcasts/421 Fri, 12 Aug 2022 12:00:00 -0400 651 work from home, COVID, patching full false     Talos Takes Ep. #55: What's next for Transparent Tribe? Talos Takes Ep. #55: What's next for Transparent Tribe? Asheer Malhotra from Talos Outreach has followed Transparent Tribe for years now. This APT has been all over the place using all sorts of trojans. So where my they go next? Asheer joins Talos Takes this week to discuss the malware this group deploys and how they use typo-squatted domains to lure victims in.

    ]]>     Asheer Malhotra from Talos Outreach has followed Transparent Tribe for years now. This APT has been all over the place using all sorts of trojans. So where my they go next? Asheer joins Talos Takes this week to discuss the malware this group deploys and how they use typo-squatted domains to lure victims in.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/420 Fri, 12 Aug 2022 12:00:00 -0400 508 malware, trojans, APTs, threats full false     Talos Takes Ep. #60 (XL Edition): Kaseya emergency show Talos Takes Ep. #60 (XL Edition): Kaseya emergency show In this special “XL edition” of Talos Takes, we’re bringing you the audio version of our live stream this week discussing the Kaseya supply chain attack. Nick Biasini from Talos Outreach went live with Hazel Burton, a Cisco product marketing manager, to discuss what transpired over the long Fourth of July weekend. 
    Nick discussed the Kaseya exploit leveraged in this campaign, plus the follow-on ransomware attacks. This is the best place to get the tl;dr on what happened, what you need to be doing now, and what Cisco Secure solutions can keep you protected.

    ]]>     In this special “XL edition” of Talos Takes, we’re bringing you the audio version of our live stream this week discussing the Kaseya supply chain attack. Nick Biasini from Talos Outreach went live with Hazel Burton, a Cisco product marketing manager, to discuss what transpired over the long Fourth of July weekend. 
    Nick discussed the Kaseya exploit leveraged in this campaign, plus the follow-on ransomware attacks. This is the best place to get the tl;dr on what happened, what you need to be doing now, and what Cisco Secure solutions can keep you protected.

    ]]>     Nick Biasini (host) and Hazel Burton (speaker) https://www.talosintelligence.com/podcasts/458 Fri, 12 Aug 2022 12:00:00 -0400 1300 Kaseya, supply chain, ransomware, REvil full false     Talos Takes Ep. #54: Incident response is really just the friends we made along the way Talos Takes Ep. #54: Incident response is really just the friends we made along the way Welcome to the unofficial incident response week at Talos! As part of the RSA Conference, we’ve released two new case studies detailing some malware cases Cisco Talos Incident Response helped resolve. Brad Garnett, this week’s guest, also released a new blog post where he wrote about why incident response is “the ultimate team sport.” Brad joins host Jon Munshaw this week to take a deeper dive into one of these engagements, in which an attacker tried to use Cobalt Strike to infect a target with ransomware (hint: this would have been really bad!) Brad talks about how the strong personal relationships CTIR built with the customer in question set everyone up for success.

    ]]>     Welcome to the unofficial incident response week at Talos! As part of the RSA Conference, we’ve released two new case studies detailing some malware cases Cisco Talos Incident Response helped resolve. Brad Garnett, this week’s guest, also released a new blog post where he wrote about why incident response is “the ultimate team sport.” Brad joins host Jon Munshaw this week to take a deeper dive into one of these engagements, in which an attacker tried to use Cobalt Strike to infect a target with ransomware (hint: this would have been really bad!) Brad talks about how the strong personal relationships CTIR built with the customer in question set everyone up for success.

    ]]>     Jon Munshaw (host) and Brad Garnett (speaker) https://www.talosintelligence.com/podcasts/418 Fri, 12 Aug 2022 12:00:00 -0400 494 incident response, Cobalt Strike, ransomware full false     Talos Takes Ep. #52: Why not a world passwordless day? Talos Takes Ep. #52: Why not a world passwordless day? To celebrate World Password Day this week, we’re talking about getting rid of passwords! Dave Lewis, a global advisory CISO for Cisco Secure, joins Jon to talk about all things passwordless. This is a new initiative Cisco Secure and Duo have undertaken to get network administrators to move away from using passwords in favor of other forms of authentication. Jon and Dave discuss why passwords can be dangerous, the benefits of going passwordless and how to convince longtime users to ditch traditional login credentials.

    ]]>     To celebrate World Password Day this week, we’re talking about getting rid of passwords! Dave Lewis, a global advisory CISO for Cisco Secure, joins Jon to talk about all things passwordless. This is a new initiative Cisco Secure and Duo have undertaken to get network administrators to move away from using passwords in favor of other forms of authentication. Jon and Dave discuss why passwords can be dangerous, the benefits of going passwordless and how to convince longtime users to ditch traditional login credentials.

    ]]>     Jon Munshaw (host) and Dave Lewis (speaker) https://www.talosintelligence.com/podcasts/415 Fri, 12 Aug 2022 12:00:00 -0400 580 passwords, passwordless, MFA, Duo full false     Talos Takes Ep. #51: COVID and tax scams go hand-in-hand this year Talos Takes Ep. #51: COVID and tax scams go hand-in-hand this year We can set our watches to tax scams every year in April. The bad guys are always looking to steal your information, promising to get you a bigger tax return or do your taxes for you. This year is a bit different because Tax Day is a bit later than usual thanks to — you guessed it — COVID. Attackers are now combining these two topics to create spam campaigns, promising to provide you new information about how COVID affects your taxes, or even promising to send you a gift in exchange for receiving your COVID vaccine. Jaeson Schultz makes his inaugural appearance on Talos Takes to discuss what he’s seeing in the wild and how you can avoid these common scams.

    ]]>     We can set our watches to tax scams every year in April. The bad guys are always looking to steal your information, promising to get you a bigger tax return or do your taxes for you. This year is a bit different because Tax Day is a bit later than usual thanks to — you guessed it — COVID. Attackers are now combining these two topics to create spam campaigns, promising to provide you new information about how COVID affects your taxes, or even promising to send you a gift in exchange for receiving your COVID vaccine. Jaeson Schultz makes his inaugural appearance on Talos Takes to discuss what he’s seeing in the wild and how you can avoid these common scams.

    ]]>     Jon Munshaw (host) and Jaeson Schultz (speaker) https://www.talosintelligence.com/podcasts/414 Fri, 12 Aug 2022 12:00:00 -0400 798 scams, spam, COVID, tax day, email full false     Talos Takes Ep. #50: Attackers are using Discord just as much as you are Talos Takes Ep. #50: Attackers are using Discord just as much as you are Cisco Talos recently discovered a wave of attackers spreading malware via collaboration apps like Discord and Slack. On this week’s episode of Talos Takes, Nick Biasini joins the show to bring us inside his research process for this post and discuss why these attacks have been so successful. Jon brings up his Dungeons & Dragons group, too, if you’re interested in that sort of thing.

    ]]>     Cisco Talos recently discovered a wave of attackers spreading malware via collaboration apps like Discord and Slack. On this week’s episode of Talos Takes, Nick Biasini joins the show to bring us inside his research process for this post and discuss why these attacks have been so successful. Jon brings up his Dungeons & Dragons group, too, if you’re interested in that sort of thing.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/413 Fri, 12 Aug 2022 12:00:00 -0400 437 malware, Discord, spam full false     Talos Takes Ep. #53: What can we learn from those air fryer vulnerabilities? Talos Takes Ep. #53: What can we learn from those air fryer vulnerabilities? Everyone had jokes when it came to the vulnerabilities we recently disclosed in a WiFi-connected air fryer. But there are actually some lessons to take away from this, such as: “Not everything needs to be connected to the internet.” Joe Marshall joins the show this week to discuss all things “smart” appliances, how to protect your network and the repercussions of these specific air fryer vulnerabilities.

    ]]>     Everyone had jokes when it came to the vulnerabilities we recently disclosed in a WiFi-connected air fryer. But there are actually some lessons to take away from this, such as: “Not everything needs to be connected to the internet.” Joe Marshall joins the show this week to discuss all things “smart” appliances, how to protect your network and the repercussions of these specific air fryer vulnerabilities.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/416 Fri, 12 Aug 2022 12:00:00 -0400 660 IoT, ICS, vulnerabilities, patching full false     Talos Takes Ep. #49: LodaRAT's connection to Android devices Talos Takes Ep. #49: LodaRAT's connection to Android devices Chris Neal from Talos Outreach has followed LodaRAT for years now. It’s gone from a fairly small threat to a full-on malware with several features that target all sorts of Android devices. Chris joins the show this week to discuss his history of researching LodaRAT and updates us on its latest TTPs. Find out how this trojan tries to trick users into downloading it on their phones and how it hunts for your banking information.

    ]]>     Chris Neal from Talos Outreach has followed LodaRAT for years now. It’s gone from a fairly small threat to a full-on malware with several features that target all sorts of Android devices. Chris joins the show this week to discuss his history of researching LodaRAT and updates us on its latest TTPs. Find out how this trojan tries to trick users into downloading it on their phones and how it hunts for your banking information.

    ]]>     Jon Munshaw (host) and Chris Neal (speaker) https://www.talosintelligence.com/podcasts/411 Fri, 12 Aug 2022 12:00:00 -0400 365 malware, trojans, banking trojan, mobile malware, LodaRAT full false     Talos Takes Ep. #48: The history of ObliqueRAT Talos Takes Ep. #48: The history of ObliqueRAT After researching and writing about ObliqueRAT for several months now, Asheer Malhotra joins Talos Takes for the first time to discuss this trojan. We’ve seen this malware evolve over the past year or so to ad new evasion techniques and find ways to avoid email filters and usual antivirus protections. Asheer talks about his history researching this malware and provides some advice on how to avoid email spam and the other maldocs these actors try to spread.

    ]]>     After researching and writing about ObliqueRAT for several months now, Asheer Malhotra joins Talos Takes for the first time to discuss this trojan. We’ve seen this malware evolve over the past year or so to ad new evasion techniques and find ways to avoid email filters and usual antivirus protections. Asheer talks about his history researching this malware and provides some advice on how to avoid email spam and the other maldocs these actors try to spread.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/410 Fri, 12 Aug 2022 12:00:00 -0400 474 ObliqueRAT, malware, trojans, spam full false     Talos Takes Ep. #45: Finding an alternative to SMS multi-factor authentication Talos Takes Ep. #45: Finding an alternative to SMS multi-factor authentication It was only a matter of time before we had Wendy Nather from Cisco Secure Duo on the show. We finally met Beers with Talos’ level of stardom, as Wendy joins the show to discuss SMS messages as a form of multi-factor authentication. We break down why SMS authentication is still around and used by some of our most important services like banks, and what alternatives are out there. We also discuss the dangers of SIM-jacking attacks and the benefits of using Duo’s app-based authentication.

    ]]>     It was only a matter of time before we had Wendy Nather from Cisco Secure Duo on the show. We finally met Beers with Talos’ level of stardom, as Wendy joins the show to discuss SMS messages as a form of multi-factor authentication. We break down why SMS authentication is still around and used by some of our most important services like banks, and what alternatives are out there. We also discuss the dangers of SIM-jacking attacks and the benefits of using Duo’s app-based authentication.

    ]]>     Wendy Nather (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/374 Fri, 12 Aug 2022 12:00:00 -0400 510 MFA, SMS, 2FA, passwords full false     Talos Takes Ep. #44: A super-sized edition for a roundtable discussion on SolarWinds Talos Takes Ep. #44: A super-sized edition for a roundtable discussion on SolarWinds Welcome to the first-ever XL edition of Talos Takes. This one is a little longer than usual, but we promise you it’s worth it. We recently brought together researchers from all corners of Talos to talk about what we know about SolarWinds so far, and what’s still to be discovered. Our various teams have spent the past several months diving deep into the SolarWinds supply chain attack, and this is a collection of Talos’ knowledge on the current situation. Talking points include whether it’s fair to refer to this campaign as “SolarWinds,” what other initial infection vectors there may be, the breadth of the attack and more boots-on-the-ground intelligence. If you want to watch the video version, head to our YouTube page.

    ]]>     Welcome to the first-ever XL edition of Talos Takes. This one is a little longer than usual, but we promise you it’s worth it. We recently brought together researchers from all corners of Talos to talk about what we know about SolarWinds so far, and what’s still to be discovered. Our various teams have spent the past several months diving deep into the SolarWinds supply chain attack, and this is a collection of Talos’ knowledge on the current situation. Talking points include whether it’s fair to refer to this campaign as “SolarWinds,” what other initial infection vectors there may be, the breadth of the attack and more boots-on-the-ground intelligence. If you want to watch the video version, head to our YouTube page.

    ]]>     Nick Biasini (speaker), Jon Munshaw (host), Joe Marshall (speaker), and Pierre Cadieux (speaker) https://www.talosintelligence.com/podcasts/373 Fri, 12 Aug 2022 12:00:00 -0400 2090 SolarWinds, Incident Response, supply chain, news, Headlines full false     Talos Takes Ep. #43: Microsoft Exchange Server emergency show Talos Takes Ep. #43: Microsoft Exchange Server emergency show We put this week’s Talos Takes episode together last minute to discuss the Microsoft Exchange Server zero-day vulnerabilities Microsoft disclosed earlier this week. Nick Biasini joins the show to discuss mitigation strategies and what these vulnerabilities mean for your environment at-large. Plus, we discuss why this is another case of patching above all else. For more coverage on this topic, check out the Talos blog.

    ]]>     We put this week’s Talos Takes episode together last minute to discuss the Microsoft Exchange Server zero-day vulnerabilities Microsoft disclosed earlier this week. Nick Biasini joins the show to discuss mitigation strategies and what these vulnerabilities mean for your environment at-large. Plus, we discuss why this is another case of patching above all else. For more coverage on this topic, check out the Talos blog.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/372 Fri, 12 Aug 2022 12:00:00 -0400 330 Microsoft, Exchange, vulnerabilities, CVEs, zero-day full false     Talos Takes Ep. #42: Seriously folks, save your logs Talos Takes Ep. #42: Seriously folks, save your logs When Pierre Cadieux steps into a Cisco Talos Incident Response engagement, the first thing he wants to do is check out the customer’s logs. But if there are no logs to be found, he’ll be pretty limited in the kinds of insights he can provide.

    This has come up several times during the SolarWinds era, when customers are wanting to know if they were targeted in the widespread supply chain attack. So in this episode of Talos Takes, Pierre joins the show to discuss why it’s so important to keep logs for everything — log-ins, events, applications and more.

    ]]>     When Pierre Cadieux steps into a Cisco Talos Incident Response engagement, the first thing he wants to do is check out the customer’s logs. But if there are no logs to be found, he’ll be pretty limited in the kinds of insights he can provide.

    This has come up several times during the SolarWinds era, when customers are wanting to know if they were targeted in the widespread supply chain attack. So in this episode of Talos Takes, Pierre joins the show to discuss why it’s so important to keep logs for everything — log-ins, events, applications and more.

    ]]>     Jon Munshaw (host) and Pierre Cadieux (speaker) https://www.talosintelligence.com/podcasts/371 Fri, 12 Aug 2022 12:00:00 -0400 449 SolarWinds, Incident Response, security logs, Cisco Talos Incident Response, security full false     Talos Takes Ep. #41: Why you should upgrade to Snort 3 Talos Takes Ep. #41: Why you should upgrade to Snort 3 For this week’s episode of Talos Takes, we’re switching back to Snort talk. For anyone who hasn’t been on security Twitter over the past month, you may not know that we released the Snort 3 GA last month — formally known as Snort 3.1.0. To celebrate, Nick Mavis joins the show again to discuss Snort 3’s new features and upgrades over 2.9.X. Nick, who regularly writes Snort rules for Cisco Talos and has been working hands-on with both versions of Snort for years, talks about how the rules improve with Snort 3, why detection and protection are better and everything else he loves about Snort 3. For more, check out the Snort 3 page on Snort.org.

    ]]>     For this week’s episode of Talos Takes, we’re switching back to Snort talk. For anyone who hasn’t been on security Twitter over the past month, you may not know that we released the Snort 3 GA last month — formally known as Snort 3.1.0. To celebrate, Nick Mavis joins the show again to discuss Snort 3’s new features and upgrades over 2.9.X. Nick, who regularly writes Snort rules for Cisco Talos and has been working hands-on with both versions of Snort for years, talks about how the rules improve with Snort 3, why detection and protection are better and everything else he loves about Snort 3. For more, check out the Snort 3 page on Snort.org.

    ]]>     Jon Munshaw (host) and Nicholas Mavis (speaker) https://www.talosintelligence.com/podcasts/369 Fri, 12 Aug 2022 12:00:00 -0400 362 Snort, Snort 3 full false     Talos Takes Ep. #47: Masslogger Talos Takes Ep. #47: Masslogger On this week’s episode of Talos Takes, we go back a month or so to reflect on the Masslogger trojan Talos wrote about earlier this year. This malware may not make national headlines, but that doesn’t mean you should just ignore it. Find out where this trojan is hiding and why it’s after your Outlook and Google Chrome login credentials.

    ]]>     On this week’s episode of Talos Takes, we go back a month or so to reflect on the Masslogger trojan Talos wrote about earlier this year. This malware may not make national headlines, but that doesn’t mean you should just ignore it. Find out where this trojan is hiding and why it’s after your Outlook and Google Chrome login credentials.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/408 Fri, 12 Aug 2022 12:00:00 -0400 291 trojan, Masslogger, malware, Threats full false     Talos Takes Ep. #40: Lessons learned from our conversations with a ransomware operator Talos Takes Ep. #40: Lessons learned from our conversations with a ransomware operator For the first time in Talos Takes history, we have a whopping TWO guests on to talk about Talos’ latest research paper. In this episode, Dmytro Korzhevin and Azim Khodjibaev discuss their work interviewing a LockBit ransomware operator. They spent multiple weeks speaking to this actor over social media, and eventually turned their conversations into a paper that lays out what we learned about the ransomware landscape. Dmytro and Azim talked about lessons learned, what surprised them about the threat actor, and how actors choose their targets.

    ]]>     For the first time in Talos Takes history, we have a whopping TWO guests on to talk about Talos’ latest research paper. In this episode, Dmytro Korzhevin and Azim Khodjibaev discuss their work interviewing a LockBit ransomware operator. They spent multiple weeks speaking to this actor over social media, and eventually turned their conversations into a paper that lays out what we learned about the ransomware landscape. Dmytro and Azim talked about lessons learned, what surprised them about the threat actor, and how actors choose their targets.

    ]]>     Jon Munshaw (host), Azim Khodjibaev (speaker), and Dmytro Korzhevin (speaker) https://www.talosintelligence.com/podcasts/367 Fri, 12 Aug 2022 12:00:00 -0400 492 LockBit, ransomware, malware full false     Talos Takes Ep. #39: An update on SolarWinds as it relates to IoT and OT Talos Takes Ep. #39: An update on SolarWinds as it relates to IoT and OT We know we just talked about supply chain attacks and SolarWinds last week, but it’s still all anyone in security is talking about. Joe Marshall joins the show this time to approach the SolarWinds breach from an internet-of-things and operational security perspective. He recently co-wrote a blog for Cisco detailing how outsourcing OT over the past few years has made the SolarWinds compromise worse. Joe, a lifelong researcher and security practitioner in the OT and infrastructure space, discusses what we still don’t know about this attack, what you should do if you think you may be affected, and how we can learn from this going forward. For more on Talos’ coverage and defense against the SolarWinds campaign, check out our blog post here.

    ]]>     We know we just talked about supply chain attacks and SolarWinds last week, but it’s still all anyone in security is talking about. Joe Marshall joins the show this time to approach the SolarWinds breach from an internet-of-things and operational security perspective. He recently co-wrote a blog for Cisco detailing how outsourcing OT over the past few years has made the SolarWinds compromise worse. Joe, a lifelong researcher and security practitioner in the OT and infrastructure space, discusses what we still don’t know about this attack, what you should do if you think you may be affected, and how we can learn from this going forward. For more on Talos’ coverage and defense against the SolarWinds campaign, check out our blog post here.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/366 Fri, 12 Aug 2022 12:00:00 -0400 749 SolarWinds, IoT, operational technology, infrastructure full false     Talos Takes Ep. #37: What's with all this talk about supply chain attacks? Talos Takes Ep. #37: What's with all this talk about supply chain attacks? The major SolarWinds campaign has been generating headlines for weeks now. And while its specific targets make this attack unique, this is far from the first-ever supply chain attack. So what is a supply chain attack? And should your organization be prepared for them? In this episode of Talos Takes, Nick Biasini talks about the history of supply chain attacks, and how they can even be traced back to the 1970s.

    ]]>     The major SolarWinds campaign has been generating headlines for weeks now. And while its specific targets make this attack unique, this is far from the first-ever supply chain attack. So what is a supply chain attack? And should your organization be prepared for them? In this episode of Talos Takes, Nick Biasini talks about the history of supply chain attacks, and how they can even be traced back to the 1970s.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/365 Fri, 12 Aug 2022 12:00:00 -0400 479 SolarWinds, malware, supply chain, APTs, FireEye full false     Talos Takes Ep. #36: Ransomware's big 2020 Talos Takes Ep. #36: Ransomware's big 2020 Everything was on fire this year, and the internet was no different. Ransomware was the leading cause of headaches and late night for defenders and IT experts this year. On the latest Talos Takes episode (and last of 2020), Azim Khodjibaev joins us to talk about ransomware’s big year. We talk about why adversaries wanted to go big-game hunting, and what this could mean for trends in 2021.

    ]]>     Everything was on fire this year, and the internet was no different. Ransomware was the leading cause of headaches and late night for defenders and IT experts this year. On the latest Talos Takes episode (and last of 2020), Azim Khodjibaev joins us to talk about ransomware’s big year. We talk about why adversaries wanted to go big-game hunting, and what this could mean for trends in 2021.

    ]]>     Jon Munshaw (host) and Azim Khodjibaev (speaker) https://www.talosintelligence.com/podcasts/362 Fri, 12 Aug 2022 12:00:00 -0400 429 ransomware, year in review, malware, spam full false     Talos Takes Ep. #46 (XL Edition): Snort 3 roundtable discussion Talos Takes Ep. #46 (XL Edition): Snort 3 roundtable discussion We’ve got another special XL episode this week, this time about Snort 3. This roundtable covers everything you could know about Snort 3’s life, going back as far as its inception in the early 2010s. We even went out of our way to get Marty Roesch, the creator of Snort.

    Marty, along with our other panelists, discusses the origins of Snort 3, what benefits you can gain by upgrading and what other features you can expect to see in the future.

    ]]>     We’ve got another special XL episode this week, this time about Snort 3. This roundtable covers everything you could know about Snort 3’s life, going back as far as its inception in the early 2010s. We even went out of our way to get Marty Roesch, the creator of Snort.

    Marty, along with our other panelists, discusses the origins of Snort 3, what benefits you can gain by upgrading and what other features you can expect to see in the future.

    ]]>     Joel Esler (host) https://www.talosintelligence.com/podcasts/375 Fri, 12 Aug 2022 12:00:00 -0400 3192 Snort, Snort 3 full false     Talos Takes Ep. #35: If a deal seems too good to be true, it probably is Talos Takes Ep. #35: If a deal seems too good to be true, it probably is More shoppers are expected to buy online this year than ever. Everyone’s encouraged to stay home and avoid lines and crowds due to the COVID-19 pandemic, which has left retailers offering deals earlier in November than ever before. So how can you stay safe while doing all your holiday shopping online? In this episode of Talos Takes, we’ll talk through some of the common schemes we’re seeing and talk about what makes this year unique when it comes to spam campaigns.

    ]]>     More shoppers are expected to buy online this year than ever. Everyone’s encouraged to stay home and avoid lines and crowds due to the COVID-19 pandemic, which has left retailers offering deals earlier in November than ever before. So how can you stay safe while doing all your holiday shopping online? In this episode of Talos Takes, we’ll talk through some of the common schemes we’re seeing and talk about what makes this year unique when it comes to spam campaigns.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/359 Fri, 12 Aug 2022 12:00:00 -0400 338 security skills, spam, online shopping, scams full false     Talos Takes Ep. #34: Free and low-cost security tools Talos Takes Ep. #34: Free and low-cost security tools Say you’ve got the basics of security down, and now you want to start putting it into practice. Where do you start? In this Talos Takes episode, we run through some free and low-cost security tools anyone can use to beef up their network. We talk about Snort, built-in security tools on operating systems and more.

    ]]>     Say you’ve got the basics of security down, and now you want to start putting it into practice. Where do you start? In this Talos Takes episode, we run through some free and low-cost security tools anyone can use to beef up their network. We talk about Snort, built-in security tools on operating systems and more.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/358 Fri, 12 Aug 2022 12:00:00 -0400 424 Snort, tools, security, IPS, firewall full false     Talos Takes Ep. #33: How to talk to your parents about cyber security Talos Takes Ep. #33: How to talk to your parents about cyber security It’s National Cyber Security Awareness Month! And you know what that means? It’s time to make everyone more aware! Since we all have that special someone in our lives who could use a refresher on internet hygenie, we figured it was time to talk about bringing up the topic of security to your friends and family who may not be as computer literate as you are. Jon Munshaw and Nick Biasini talk about basic tips to give even your oldest family members and user-friendly programs and services that can improve everyone’s security.

    ]]>     It’s National Cyber Security Awareness Month! And you know what that means? It’s time to make everyone more aware! Since we all have that special someone in our lives who could use a refresher on internet hygenie, we figured it was time to talk about bringing up the topic of security to your friends and family who may not be as computer literate as you are. Jon Munshaw and Nick Biasini talk about basic tips to give even your oldest family members and user-friendly programs and services that can improve everyone’s security.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/355 Fri, 12 Aug 2022 12:00:00 -0400 485 cyber security, security, internet, browsers full false     Talos Takes Ep. #32: How to keep your children safe while they attend school online Talos Takes Ep. #32: How to keep your children safe while they attend school online Jon doesn’t have any children. So he found someone who does — Beers with Talos’ own Craig Williams — to talk about remote learning. Children are back to school, and many of them are doing so online. Craig and Jon talk about DNS filters, parental controls, meeting passwords and more that are sure to help parents and teachers adjust to this new normal.

    ]]>     Jon doesn’t have any children. So he found someone who does — Beers with Talos’ own Craig Williams — to talk about remote learning. Children are back to school, and many of them are doing so online. Craig and Jon talk about DNS filters, parental controls, meeting passwords and more that are sure to help parents and teachers adjust to this new normal.

    ]]>     Jon Munshaw (host) https://www.talosintelligence.com/podcasts/354 Fri, 12 Aug 2022 12:00:00 -0400 488 school, online learning full false     Talos Takes Ep. #28: Sharing information on information-sharing Talos Takes Ep. #28: Sharing information on information-sharing Talos intakes a ridiculous amount of information every day. So how do we parse what is and isn’t important enough to share? In this episode of Talos Takes, Amy Henderson from our Threat Intelligence and Interdiction team talks about our information-sharing partnerships with both private and public entities. How do we disseminate important information to our friends in the field? And why are security organizations like the Cyber Threat Alliance so important?

    ]]>     Talos intakes a ridiculous amount of information every day. So how do we parse what is and isn’t important enough to share? In this episode of Talos Takes, Amy Henderson from our Threat Intelligence and Interdiction team talks about our information-sharing partnerships with both private and public entities. How do we disseminate important information to our friends in the field? And why are security organizations like the Cyber Threat Alliance so important?

    ]]>     Amy Henderson (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/347 Fri, 12 Aug 2022 12:00:00 -0400 641 information sharing, intel, threat intel, Talos, CTA full false     Talos Takes Ep. #27: Why are we so obsessed with attribution? Talos Takes Ep. #27: Why are we so obsessed with attribution? On this episode of Talos Takes, we talk all about attribution. Our guest, Martin Lee, recently co-authored a post on the hurdles government agencies and private researchers alike face when trying to place blame for a cyber attack. Martin talks about why we’re so obsessed with placing the blame, what false flags are and what helpful things can actually come from attributing a threat.

    ]]>     On this episode of Talos Takes, we talk all about attribution. Our guest, Martin Lee, recently co-authored a post on the hurdles government agencies and private researchers alike face when trying to place blame for a cyber attack. Martin talks about why we’re so obsessed with placing the blame, what false flags are and what helpful things can actually come from attributing a threat.

    ]]>     Jon Munshaw (host) and Martin Lee (speaker) https://www.talosintelligence.com/podcasts/346 Fri, 12 Aug 2022 12:00:00 -0400 596 attribution, APTs, malware full false     Talos Takes Ep. #26: How to safely browse the web Talos Takes Ep. #26: How to safely browse the web There are so many options now for basic web browsing. There are ad-blocking plugins, privacy browsers, incognito mode, password managers — but for the average user, this can be a lot to keep up with. In this episode of Talos Takes, we dissect all these options and talk about what your best options are to keep your information safe while doing some everyday web browsing.

    ]]>     There are so many options now for basic web browsing. There are ad-blocking plugins, privacy browsers, incognito mode, password managers — but for the average user, this can be a lot to keep up with. In this episode of Talos Takes, we dissect all these options and talk about what your best options are to keep your information safe while doing some everyday web browsing.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/343 Fri, 12 Aug 2022 12:00:00 -0400 491 web browsers, privacy, passwords full false     Talos Takes Ep. #25: WastedLocker Talos Takes Ep. #25: WastedLocker This week’s Talos Takes episode is another malware deep dive. Edmund Brumaghin joins the show to talk about WastedLocker, a recent ransomware family he and some other Talos researchers reverse-engineered. Here’s everything you need to know about what makes this threat unique and how it uses LoLBins to survive.

    ]]>     This week’s Talos Takes episode is another malware deep dive. Edmund Brumaghin joins the show to talk about WastedLocker, a recent ransomware family he and some other Talos researchers reverse-engineered. Here’s everything you need to know about what makes this threat unique and how it uses LoLBins to survive.

    ]]>     Edmund Brumaghin (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/342 Fri, 12 Aug 2022 12:00:00 -0400 317 LoLBins, WastedLocker, ransomware full false     Talos Takes Ep. #23: How Talos utilizes honeypots Talos Takes Ep. #23: How Talos utilizes honeypots Honeypots are an important part of threat research and detection. In this episode of Talos Takes, we talk to Christopher Evans, who is our resident honeypot expert at Talos. Chris talks about how he uses them every day, why they’re important to Talos’ overall mission and balancing the use of them with the potential for making attackers smarter.

    ]]>     Honeypots are an important part of threat research and detection. In this episode of Talos Takes, we talk to Christopher Evans, who is our resident honeypot expert at Talos. Chris talks about how he uses them every day, why they’re important to Talos’ overall mission and balancing the use of them with the potential for making attackers smarter.

    ]]>     Jon Munshaw (host) and Christopher Evans (speaker) https://www.talosintelligence.com/podcasts/339 Fri, 12 Aug 2022 12:00:00 -0400 631 honeypots, threat intelligence, threat detection full false     Talos Takes Ep. #24: LoLBins Talos Takes Ep. #24: LoLBins LoLBins sound like they’d be funny, but they’re anything but. These “living-off-the-land binaries” make it so that attackers can more easily hide on your system as they disguise themselves as legitimate processes. On this episode of Talos Takes, Nick Biasini talks about what LoLBins are, exactly, how adversaries use them and how you can spot them on your environment.

    ]]>     LoLBins sound like they’d be funny, but they’re anything but. These “living-off-the-land binaries” make it so that attackers can more easily hide on your system as they disguise themselves as legitimate processes. On this episode of Talos Takes, Nick Biasini talks about what LoLBins are, exactly, how adversaries use them and how you can spot them on your environment.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/340 Fri, 12 Aug 2022 12:00:00 -0400 327 LoLBins, binaries, PowerShell full false     Talos Takes Ep. #29: Election security roundtable excerpt Talos Takes Ep. #29: Election security roundtable excerpt This week’s episode is actually an excerpt from our recently released roundtable on disinformation and American election security. This is a small part of our larger discussion on fake news, state-sponsored actors using fake social media accounts, and what can be done to combat the spread of disinformation. To see the whole thing, click here.

    ]]>     This week’s episode is actually an excerpt from our recently released roundtable on disinformation and American election security. This is a small part of our larger discussion on fake news, state-sponsored actors using fake social media accounts, and what can be done to combat the spread of disinformation. To see the whole thing, click here.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/349 Fri, 12 Aug 2022 12:00:00 -0400 416 disinformation, fake news, election security full false     Talos Takes Ep. #22: Snort 101 Talos Takes Ep. #22: Snort 101 The quick and dirty beginner’s guide to what Snort is and how to use. This the podcast accompaniment to the rest of our Snort 101 materials, which can be found on Snort.org/Resources.

    ]]>     The quick and dirty beginner’s guide to what Snort is and how to use. This the podcast accompaniment to the rest of our Snort 101 materials, which can be found on Snort.org/Resources.

    ]]>     Jon Munshaw (host) and Nicholas Mavis (speaker) https://www.talosintelligence.com/podcasts/302 Fri, 12 Aug 2022 12:00:00 -0400 387 Snort, Snort rules, Talos rules full false     Talos Takes Ep. #21: What's really hiding inside the dark web Talos Takes Ep. #21: What's really hiding inside the dark web The dark web sounds scary — and it is. But what exactly does this dark web consist of? Despite what the name may suggest, it’s actually not people selling organs or stolen video games that happened to fall off the back of a truck. But what is actually on these forums? Azim Khodjibaev joins Jon Munshaw this week to discuss his experience with the dark web.

    ]]>     The dark web sounds scary — and it is. But what exactly does this dark web consist of? Despite what the name may suggest, it’s actually not people selling organs or stolen video games that happened to fall off the back of a truck. But what is actually on these forums? Azim Khodjibaev joins Jon Munshaw this week to discuss his experience with the dark web.

    ]]>     Jon Munshaw (host) and Azim Khodjibaev (speaker) https://www.talosintelligence.com/podcasts/301 Fri, 12 Aug 2022 12:00:00 -0400 542 dark web, Talos Takes, podcasts, stolen information full false     Talos Takes Ep. #20: What is an APT, exactly? Talos Takes Ep. #20: What is an APT, exactly? We use the term “APT” in cyber security a lot. But what does it mean, exactly? Does a group have to break a certain threshold to become an APT? Does the term refer to a specific malware family or a group of actors? On this week’s Talos Takes, Jon Munshaw talks to Azim from Talos’ Threat Intelligence team about this very topic.

    ]]>     We use the term “APT” in cyber security a lot. But what does it mean, exactly? Does a group have to break a certain threshold to become an APT? Does the term refer to a specific malware family or a group of actors? On this week’s Talos Takes, Jon Munshaw talks to Azim from Talos’ Threat Intelligence team about this very topic.

    ]]>     Jon Munshaw (host) and Azim Khodjibaev (speaker) https://www.talosintelligence.com/podcasts/295 Fri, 12 Aug 2022 12:00:00 -0400 397 APTs, threat actors, threats full false     Talos Takes Ep. #19: How to keep your online meetings safe Talos Takes Ep. #19: How to keep your online meetings safe Everyone is meeting virtually now. Whether it be important business or the average happy hour with friends and family, there’s no shortage of invites to chat rooms, presentations and software you’ve never heard of before you started working from home. And, of course, this software comes with its own set of security concerns and vulnerabilities. So Matt Valites joins Jon Munshaw this week to talk about the basics of securing your next friendly meetup or presentation to the board.

    ]]>     Everyone is meeting virtually now. Whether it be important business or the average happy hour with friends and family, there’s no shortage of invites to chat rooms, presentations and software you’ve never heard of before you started working from home. And, of course, this software comes with its own set of security concerns and vulnerabilities. So Matt Valites joins Jon Munshaw this week to talk about the basics of securing your next friendly meetup or presentation to the board.

    ]]>     Jon Munshaw (host) https://www.talosintelligence.com/podcasts/293 Fri, 12 Aug 2022 12:00:00 -0400 305 meetings, online, video chat, video conferencing, Zoom, WebEx full false     Talos Takes Ep. #18: Where do cryptominers stand in 2020? Talos Takes Ep. #18: Where do cryptominers stand in 2020? The value of cryptocurrencies is nowhere near where it was just two years ago. So does that mean cryptominers have gone away as a threat? Jon Munshaw and Nick Biasini sit down in this episode of Talos Takes to discuss where cryptominers stand in 2020. Why aren’t we reading about them as much? And why is being hit with one a sign of worse things to come?

    ]]>     The value of cryptocurrencies is nowhere near where it was just two years ago. So does that mean cryptominers have gone away as a threat? Jon Munshaw and Nick Biasini sit down in this episode of Talos Takes to discuss where cryptominers stand in 2020. Why aren’t we reading about them as much? And why is being hit with one a sign of worse things to come?

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/291 Fri, 12 Aug 2022 12:00:00 -0400 381 cryptominers, malware, miners, cryptocurrencies full false     Talos Takes Ep. #17: How MedusaLocker is different than other ransomware Talos Takes Ep. #17: How MedusaLocker is different than other ransomware We published our findings on a ransomware family known as MedusaLocker last week. On its surface, it’s just like any other ransomware family — steals your stuff, encrypts it, and asks for some money to get it back. But there are some secret tricks hidden beneath the surface, and Edmund Brumaghin is here to talk about them.

    ]]>     We published our findings on a ransomware family known as MedusaLocker last week. On its surface, it’s just like any other ransomware family — steals your stuff, encrypts it, and asks for some money to get it back. But there are some secret tricks hidden beneath the surface, and Edmund Brumaghin is here to talk about them.

    ]]>     Edmund Brumaghin (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/289 Fri, 12 Aug 2022 12:00:00 -0400 273 ransomware, MedusaLocker, malware full false     Talos Takes Ep. #16: Inside thew newly discovered PoetRAT Talos Takes Ep. #16: Inside thew newly discovered PoetRAT Threat actors all over the place are trying to capitalize on COVID-19. We recently discovered a campaign we’re calling “PoetRAT” using lure documents themed around the pandemic attempting to trick victims into downloading malware. In this week’s Talos Takes episode, Nick Biasini chats with one of the researchers on the project, Warren Mercer, about this threat.

    ]]>     Threat actors all over the place are trying to capitalize on COVID-19. We recently discovered a campaign we’re calling “PoetRAT” using lure documents themed around the pandemic attempting to trick victims into downloading malware. In this week’s Talos Takes episode, Nick Biasini chats with one of the researchers on the project, Warren Mercer, about this threat.

    ]]>     Nick Biasini (host) https://www.talosintelligence.com/podcasts/287 Fri, 12 Aug 2022 12:00:00 -0400 480 APTs, threat actors, COVID-19, PoetRAT full false     Talos Takes Ep. #15: What is FUD and how adversaries leverage it Talos Takes Ep. #15: What is FUD and how adversaries leverage it Threat researchers like to throw around the acronym “FUD” a lot. But is FUD, exactly? Why should you look out for it? And why do attackers win when they sow FUD? Joe Marshall and Jon Munshaw walk you through fear, uncertainty and doubt and discuss why panic and misinformation play right into attackers’ hands.

    ]]>     Threat researchers like to throw around the acronym “FUD” a lot. But is FUD, exactly? Why should you look out for it? And why do attackers win when they sow FUD? Joe Marshall and Jon Munshaw walk you through fear, uncertainty and doubt and discuss why panic and misinformation play right into attackers’ hands.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/285 Fri, 12 Aug 2022 12:00:00 -0400 437 FUD, APTs, fake news, misinformation full false     Talos Takes Ep. #14: Summing up our recent research on fingerprint scanners Talos Takes Ep. #14: Summing up our recent research on fingerprint scanners Earlier this week, we released an in-depth blog post on fingerprint scanners used as physical security gates on devices. To save you a bit of time, and to summarize it for those non-technical folks out there, Nick Biasini and Jon Munshaw dedicate this episode to breaking down Talos’ research. What was the endgame of our research? And can you rely only on your fingerprint to keep your device secure?

    ]]>     Earlier this week, we released an in-depth blog post on fingerprint scanners used as physical security gates on devices. To save you a bit of time, and to summarize it for those non-technical folks out there, Nick Biasini and Jon Munshaw dedicate this episode to breaking down Talos’ research. What was the endgame of our research? And can you rely only on your fingerprint to keep your device secure?

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/283 Fri, 12 Aug 2022 12:00:00 -0400 357 fingerprint, mobile security, security, device security, fingerprint scanners, biometrics full false     Talos Takes Ep. #13: Special precautions to take with VPN and RDP Talos Takes Ep. #13: Special precautions to take with VPN and RDP People across the world are working from home now, and employers are increasingly turning to VPN services and Windows Remote Desktop Protocol to make sure their workers have access to their files. In this Talos Takes episode, we run down some common security concerns with these services and discuss what employees should do to stay safe while accessing their files online.

    ]]>     People across the world are working from home now, and employers are increasingly turning to VPN services and Windows Remote Desktop Protocol to make sure their workers have access to their files. In this Talos Takes episode, we run down some common security concerns with these services and discuss what employees should do to stay safe while accessing their files online.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/248 Fri, 12 Aug 2022 12:00:00 -0400 329 working from home, COVID-19, WFH, coronavirus, RDP, VPN, remote access full false     Talos Takes Ep. #12: Preparing for the worst with Cisco Talos Incident Response Talos Takes Ep. #12: Preparing for the worst with Cisco Talos Incident Response Now that Cisco Incident Response has been a part of the Talos family for a few months now, we figured it was time to check back in with them. On this episode of Talos Takes, Brad Garnett from CTIR joins the show to talk about his organization’s new Cyber Range offering, part of the standard CTIR retainer. Brad discusses how a Cyber Range exercise can prepare your organization for the worst and how it helps dispel some myths around what happens during a cyber intrusion.

    ]]>     Now that Cisco Incident Response has been a part of the Talos family for a few months now, we figured it was time to check back in with them. On this episode of Talos Takes, Brad Garnett from CTIR joins the show to talk about his organization’s new Cyber Range offering, part of the standard CTIR retainer. Brad discusses how a Cyber Range exercise can prepare your organization for the worst and how it helps dispel some myths around what happens during a cyber intrusion.

    ]]>     Jon Munshaw (host) and Brad Garnett (speaker) https://www.talosintelligence.com/podcasts/247 Fri, 12 Aug 2022 12:00:00 -0400 439 incident response, CTIR, Talos Incident Response, Cyber Range full false     Talos Takes Ep. #10: The basics of RATs Talos Takes Ep. #10: The basics of RATs We’ve been covering several different generic types of malware over the past few weeks. Next up, we’ve got our overview of remote access trojans (or tools), also known as RATs. What goes into a RAT, and how is it different than other types of malware? What are some of their inherent capabiliites? We/ve got the rundown here.

    ]]>     We’ve been covering several different generic types of malware over the past few weeks. Next up, we’ve got our overview of remote access trojans (or tools), also known as RATs. What goes into a RAT, and how is it different than other types of malware? What are some of their inherent capabiliites? We/ve got the rundown here.

    ]]>     Nick Biasini (host) https://www.talosintelligence.com/podcasts/244 Fri, 12 Aug 2022 12:00:00 -0400 261 trojans, RATs, remote access tools, malware, backdoors full false     Talos Takes Ep. #11: Avoiding fake news during the times of COVID-19 Talos Takes Ep. #11: Avoiding fake news during the times of COVID-19 Don’t attackers know we need a break right now? Alas, they’re doing everything they can to capitalize on the COVID-19 pandemic. This includes spreading fear, uncertainty and doubt with fake news, malicious advertisements and misleading information. In this Talos Takes episode, former journalist Jon Munshaw and researcher Nick Biasini discuss best practices for fact-checking, avoiding fake news and intaking the correct information during this trying time.

    ]]>     Don’t attackers know we need a break right now? Alas, they’re doing everything they can to capitalize on the COVID-19 pandemic. This includes spreading fear, uncertainty and doubt with fake news, malicious advertisements and misleading information. In this Talos Takes episode, former journalist Jon Munshaw and researcher Nick Biasini discuss best practices for fact-checking, avoiding fake news and intaking the correct information during this trying time.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/246 Fri, 12 Aug 2022 12:00:00 -0400 377 coronavirus, COVID-19, COVID, virus, pandemic, fake news, spam, malicious advertising, malvertising full false     Talos Takes Ep. #9: The basics of information stealers Talos Takes Ep. #9: The basics of information stealers Yes, adversaries are always looking for new ways to make money. But what’s their No. 2 priority? Information. In this episode of Talos Takes, Nick Biasini and Earl Carter break down the basics of information-stealers and why they’re so important to keep out.

    ]]>     Yes, adversaries are always looking for new ways to make money. But what’s their No. 2 priority? Information. In this episode of Talos Takes, Nick Biasini and Earl Carter break down the basics of information-stealers and why they’re so important to keep out.

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/242 Fri, 12 Aug 2022 12:00:00 -0400 245 infostealers, information stealers, malware, spam full false     Talos Takes Ep. #4: What's the best way to manage your passwords? Talos Takes Ep. #4: What's the best way to manage your passwords? Talos Takes is finally back with its own feed and a new episode. Nick Biasini and Earl Carter discuss the best password practices. Should you use a password manager? What are some best practices? And what does all of this have to do with Disney Plus?

    ]]>     Talos Takes is finally back with its own feed and a new episode. Nick Biasini and Earl Carter discuss the best password practices. Should you use a password manager? What are some best practices? And what does all of this have to do with Disney Plus?

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/232 Fri, 12 Aug 2022 12:00:00 -0400 336 passwords, password managers, accounts, data breach full false     Talos Takes Ep. #30: Spamming from Salfram Talos Takes Ep. #30: Spamming from Salfram On this week’s episode, Edmund Brumaghin joins the show again to talk about a recent blog post on Salfram. This threat actor is spreading lots and lots of spam and using it to deliver a variety of malware. Here’s why this threat specifically caught our eye and how it’s evolving over time.

    ]]>     On this week’s episode, Edmund Brumaghin joins the show again to talk about a recent blog post on Salfram. This threat actor is spreading lots and lots of spam and using it to deliver a variety of malware. Here’s why this threat specifically caught our eye and how it’s evolving over time.

    ]]>     Edmund Brumaghin (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/350 Fri, 12 Aug 2022 12:00:00 -0400 294 Salfram, spam, phishing, malware full false     Talos Takes Ep. #8: Decoding the EKANS malware Talos Takes Ep. #8: Decoding the EKANS malware In this episode of Talos Takes, content manager Jon Munshaw sits down with researcher Joe Marshall to discuss the recently discovered EKANS/SNAKE malware. This is one of the first ransomware strains to specifically target ICS systems. And Joe, who has experiencing protecting the ICS space, discusses what’s unique about this family and what it means for the future of cyber security in the infrastructure field.

    ]]>     In this episode of Talos Takes, content manager Jon Munshaw sits down with researcher Joe Marshall to discuss the recently discovered EKANS/SNAKE malware. This is one of the first ransomware strains to specifically target ICS systems. And Joe, who has experiencing protecting the ICS space, discusses what’s unique about this family and what it means for the future of cyber security in the infrastructure field.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/241 Fri, 12 Aug 2022 12:00:00 -0400 347 ransomware, ICS, infrastructure, manufacturing, EKANS, SNAKE, ICS malware, IoT full false     Talos Takes Ep. #7: How attackers are capitalizing on coronavirus fears Talos Takes Ep. #7: How attackers are capitalizing on coronavirus fears With the RSA conference just days away, notable vendors such as IBM and AT&T have withdrawn from the annual event over coronavirus concerns. The fast-spreading disease has captured headlines across the globe, and adversaries are trying to strike quickly. Continuing our look at attackers’ use of current events to spread malware, Nick Biasini and Earl Carter sit down to discuss malware campaigns that are hoping to scare victims into opening malicious emails and documents on coronavirus.

    ]]>     With the RSA conference just days away, notable vendors such as IBM and AT&T have withdrawn from the annual event over coronavirus concerns. The fast-spreading disease has captured headlines across the globe, and adversaries are trying to strike quickly. Continuing our look at attackers’ use of current events to spread malware, Nick Biasini and Earl Carter sit down to discuss malware campaigns that are hoping to scare victims into opening malicious emails and documents on coronavirus.

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/239 Fri, 12 Aug 2022 12:00:00 -0400 292 news, cyber news, malware, spam, coronavirus, maldocs, RSA full false     Talos Takes Ep. #6: Big Game Hunting Talos Takes Ep. #6: Big Game Hunting With the Equifax attack back in the headlines, we take a closer look at Big Game Hunting this week on Talos Takes. Why do threat actors look at these massive targets, and what do they hope to get out of it? Is there anything smaller organizations can learn from these high-stakes campaigns?

    ]]>     With the Equifax attack back in the headlines, we take a closer look at Big Game Hunting this week on Talos Takes. Why do threat actors look at these massive targets, and what do they hope to get out of it? Is there anything smaller organizations can learn from these high-stakes campaigns?

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/237 Fri, 12 Aug 2022 12:00:00 -0400 275 Big Game Hunting, APTs, big name, threat actors, state-sponsored actors, malware, cyber attacks full false     Talos Takes Ep. #5: The evolution of ransomware Talos Takes Ep. #5: The evolution of ransomware 2019 was a huge year for ransomware. Cities across the U.S. had their government services attacked, and adversaries changed up their techniques in the hopes of making a larger profit and infecting more users. What other changes do we see coming to the ransomware space? Are adversaries’ motivations changing at all? And will defense techniques change along with them?

    ]]>     2019 was a huge year for ransomware. Cities across the U.S. had their government services attacked, and adversaries changed up their techniques in the hopes of making a larger profit and infecting more users. What other changes do we see coming to the ransomware space? Are adversaries’ motivations changing at all? And will defense techniques change along with them?

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/236 Fri, 12 Aug 2022 12:00:00 -0400 253 ransomware, ransom payments, extortion, RATs, trojans full false     Talos Takes Ep. #2: How to keep your fancy new IoT toy secure Talos Takes Ep. #2: How to keep your fancy new IoT toy secure The holidays have come and gone, and so have the sales. Maybe you got a new drone, or a home AI assistant. So what should you do to make sure those new toys don’t turn against you? Nick Biasini and Earl Carter have some tips for you.

    ]]>     The holidays have come and gone, and so have the sales. Maybe you got a new drone, or a home AI assistant. So what should you do to make sure those new toys don’t turn against you? Nick Biasini and Earl Carter have some tips for you.

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/235 Fri, 12 Aug 2022 12:00:00 -0400 306 IoT, tech, smart devices, patching, smart, vulnerabilities full false     Talos Takes Ep. #3: The basics of malvertising Talos Takes Ep. #3: The basics of malvertising We’ve all seen the supposed stories online that promise to give you “The one secret to weight loss doctors WON’T tell you about.” Or “You won’t believe who Kim Kardashian is talking about now.” So how harmful are these malicious ads? Why do some of them deliver malware, and others don’t? In this episode of Talos Takes, Nick Biasini and Earl Carter dive into the basics of malvertising.

    ]]>     We’ve all seen the supposed stories online that promise to give you “The one secret to weight loss doctors WON’T tell you about.” Or “You won’t believe who Kim Kardashian is talking about now.” So how harmful are these malicious ads? Why do some of them deliver malware, and others don’t? In this episode of Talos Takes, Nick Biasini and Earl Carter dive into the basics of malvertising.

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/233 Fri, 12 Aug 2022 12:00:00 -0400 373 malvertising, malicious ads, advertising, malware, spam full false     Talos Takes Ep. #1: How to avoid common holiday shopping scams Talos Takes Ep. #1: How to avoid common holiday shopping scams We first brought you this episode in the Beers with Talos feedback in December. We’re uploading this to the Talos Takes feed for posterity now, and let’s face it, these holiday shopping reminders can apply to any time you’re shopping online.

    ]]>     We first brought you this episode in the Beers with Talos feedback in December. We’re uploading this to the Talos Takes feed for posterity now, and let’s face it, these holiday shopping reminders can apply to any time you’re shopping online.

    ]]>     Nick Biasini (host) and Jon Munshaw (speaker) https://www.talosintelligence.com/podcasts/234 Fri, 12 Aug 2022 12:00:00 -0400 257 holiday, shopping, scams, holiday shopping, online scams, spam full false     Talos Takes Ep. #31: Diving even deeper into Cobalt Strike Talos Takes Ep. #31: Diving even deeper into Cobalt Strike Snort researcher and rule-writer Nick Mavis takes time out of his busy schedule to join us again this week. Nick recently published a research paper on the bevy of detection he wrote for Cobalt Strike, a tool attackers are increasingly using. Nick talks about his process of working on the paper, why Cobalt Strike has become so popular and what he learned during the research process.

    ]]>     Snort researcher and rule-writer Nick Mavis takes time out of his busy schedule to join us again this week. Nick recently published a research paper on the bevy of detection he wrote for Cobalt Strike, a tool attackers are increasingly using. Nick talks about his process of working on the paper, why Cobalt Strike has become so popular and what he learned during the research process.

    ]]>     Jon Munshaw (host) and Nicholas Mavis (speaker) https://www.talosintelligence.com/podcasts/352 Fri, 12 Aug 2022 12:00:00 -0400 300 Cobalt Strike, Snort, malware, detection full false     Talos Takes Ep. #108 (XL Edition): On Air with Cisco Talos Incident Response Talos Takes Ep. #108 (XL Edition): On Air with Cisco Talos Incident Response This week’s episode of Talos Takes is a special extra large edition. We’ve got the audio version of our recent Cisco Talos Incident Response On Air stream where some of our responders got together to discuss the past threats of the top quarter. Liz Waddell and other team members covered everything from recent ransomware actor drama, to the importance of saving logs and other tips they picked up over the past few months.

    ]]>     This week’s episode of Talos Takes is a special extra large edition. We’ve got the audio version of our recent Cisco Talos Incident Response On Air stream where some of our responders got together to discuss the past threats of the top quarter. Liz Waddell and other team members covered everything from recent ransomware actor drama, to the importance of saving logs and other tips they picked up over the past few months.

    ]]>     Liz Waddell (host), Brett Ellis (speaker), and Nate Pors (speaker) https://www.talosintelligence.com/podcasts/665 Fri, 12 Aug 2022 12:00:00 -0400 2576 Incident Response, trends, CTIR, stream, ransomware full false     Talos Takes Ep. #107: Infostealers 101 Talos Takes Ep. #107: Infostealers 101 It’s been a while since we re-visited our Malware 101 series. So we’re going back to class to learn about information-stealers. Aliza Johnson from the Talos Threat Intelligence & Interdiction team joins the show to talk about her recent research into and overview of infostealers. Although the name is pretty self-explanatory, this type of malware comes in many shapes and sizes for many purposes.

    ]]>     It’s been a while since we re-visited our Malware 101 series. So we’re going back to class to learn about information-stealers. Aliza Johnson from the Talos Threat Intelligence & Interdiction team joins the show to talk about her recent research into and overview of infostealers. Although the name is pretty self-explanatory, this type of malware comes in many shapes and sizes for many purposes.

    ]]>     Jon Munshaw (host) and Aliza Johnson (speaker) https://www.talosintelligence.com/podcasts/664 Fri, 12 Aug 2022 12:00:00 -0400 488 malware, cyber attack, infostealers, data theft full false     Talos Takes Ep. #106: The top attacker trends from the past quarter Talos Takes Ep. #106: The top attacker trends from the past quarter Nate Pors joins the show this week to recap the recently released Cisco Talos Incident Response Quarterly Report. He and Jon recap the top attacker trends from the past quarter, including highlighting which types of attacks CTIR saw in the field and what new techniques adversaries are using. Topics discussed include the increased targeting of telecommunications companies, a decline in ransomware attacks and more business email compromise.

    ]]>     Nate Pors joins the show this week to recap the recently released Cisco Talos Incident Response Quarterly Report. He and Jon recap the top attacker trends from the past quarter, including highlighting which types of attacks CTIR saw in the field and what new techniques adversaries are using. Topics discussed include the increased targeting of telecommunications companies, a decline in ransomware attacks and more business email compromise.

    ]]>     Jon Munshaw (host) and Nate Pors (speaker) https://www.talosintelligence.com/podcasts/662 Fri, 12 Aug 2022 12:00:00 -0400 488 Incident response, ransomware, malware, quarterly trends, APTs, BEC full false     Talos Takes Ep. #105: We return once more to Transparent Tribe Talos Takes Ep. #105: We return once more to Transparent Tribe Yes, this is the third time we’ve talked about Transparent Tribe on Talos Takes, you’re not going crazy. But they keep giving us reasons to bring them up! This time, Nick Biasini joins the show to discuss the latest evolution of this threat actor: The targeting of higher education institutions in India. Jon and Nick discuss why colleges are always a high-priority target and what this could mean for the evolution of the actor.

    ]]>     Yes, this is the third time we’ve talked about Transparent Tribe on Talos Takes, you’re not going crazy. But they keep giving us reasons to bring them up! This time, Nick Biasini joins the show to discuss the latest evolution of this threat actor: The targeting of higher education institutions in India. Jon and Nick discuss why colleges are always a high-priority target and what this could mean for the evolution of the actor.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/661 Fri, 12 Aug 2022 12:00:00 -0400 394 Transparent Tribe, threat actor, colleges, higher education, intellectual property full false     Talos Takes Ep. #104: The psychology of multi-factor authentication Talos Takes Ep. #104: The psychology of multi-factor authentication We go back to college this week with a Psychology 101 class. And today, we’re covering multi-factor authentication. Jon has Dave Lewis, one of Cisco Duo’s advisory CISOs, on the show to talk about the psychology behind using these apps and talking to users about implementing it across their environments. They discuss moving around the accept and reject buttons in the UI, how we communicate the benefits of MFA to administrators and the recent wave of brute-force attacks.

    ]]>     We go back to college this week with a Psychology 101 class. And today, we’re covering multi-factor authentication. Jon has Dave Lewis, one of Cisco Duo’s advisory CISOs, on the show to talk about the psychology behind using these apps and talking to users about implementing it across their environments. They discuss moving around the accept and reject buttons in the UI, how we communicate the benefits of MFA to administrators and the recent wave of brute-force attacks.

    ]]>     Jon Munshaw (host) and Dave Lewis (speaker) https://www.talosintelligence.com/podcasts/659 Fri, 12 Aug 2022 12:00:00 -0400 560 MFA, multi-factor authentication, brute force full false     Talos Takes Ep. #103: What we can learn from a recent AvosLocker attack Talos Takes Ep. #103: What we can learn from a recent AvosLocker attack Chris Neal from Talos Outreach recently dove into a recent AvosLocker ransomware attack in the wild. This week, he joins the show to recap his major takeaways from this attack that other potential targets can learn from. He and Jon talk about the current ransomware-as-a-service landscape, the use of living-off-the-land binaries and other calling cards from this actor to keep an eye out for.

    ]]>     Chris Neal from Talos Outreach recently dove into a recent AvosLocker ransomware attack in the wild. This week, he joins the show to recap his major takeaways from this attack that other potential targets can learn from. He and Jon talk about the current ransomware-as-a-service landscape, the use of living-off-the-land binaries and other calling cards from this actor to keep an eye out for.

    ]]>     Jon Munshaw (host) and Chris Neal (speaker) https://www.talosintelligence.com/podcasts/657 Fri, 12 Aug 2022 12:00:00 -0400 508 LoLBins, ransomware, AvosLocker, cyber attack, ransomware-as-a-service full false     Talos Takes Ep. #102: Unmasking ransomware groups on the dark web Talos Takes Ep. #102: Unmasking ransomware groups on the dark web Paul Eubanks joins this week’s episode of Talos Takes to look at his recent blog post on de-anonymizing ransomware groups on the whispers dark web. Paul and his team recently used several tactics to unmask several threat actors and disclosure their tactics to stay hidden. Jon interviews Paul about ransomware actors’ usual operations on the dark web, the specific tools and tactics he used and the pros and cons of calling out actors for their opsec failures.

    ]]>     Paul Eubanks joins this week’s episode of Talos Takes to look at his recent blog post on de-anonymizing ransomware groups on the whispers dark web. Paul and his team recently used several tactics to unmask several threat actors and disclosure their tactics to stay hidden. Jon interviews Paul about ransomware actors’ usual operations on the dark web, the specific tools and tactics he used and the pros and cons of calling out actors for their opsec failures.

    ]]>     Jon Munshaw (host) and Paul Eubanks (speaker) https://www.talosintelligence.com/podcasts/656 Fri, 12 Aug 2022 12:00:00 -0400 497 ransomware, dark web, APTs full false     Talos Takes Ep. #101: Cisco Live Talos roundup Talos Takes Ep. #101: Cisco Live Talos roundup Jon reports live from the floor of Cisco Live U.S. this week. He interviewed several Talos speakers about their talks at Cisco Live and some of the major takeaways from conversations with users and customers this week.

    ]]>     Jon reports live from the floor of Cisco Live U.S. this week. He interviewed several Talos speakers about their talks at Cisco Live and some of the major takeaways from conversations with users and customers this week.

    ]]>     Jon Munshaw (host), Joe Marshall (speaker), and Alexis Merritt (speaker) https://www.talosintelligence.com/podcasts/655 Fri, 12 Aug 2022 12:00:00 -0400 304 Cisco Live, ICS, cybersecurity, incident response, CTIR full false     Talos Takes Ep. #100: Cisco Live U.S. preview Talos Takes Ep. #100: Cisco Live U.S. preview Get ready for Cisco Live next week in Vegas with a quick primer on everything Talos has going on at the conference. We’re excited to be back in person interacting with customers and users. Jon has a complete rundown of the Talos space at the conference, some talk highlights and other things you should know before you go. For a complete agenda, check out the Cisco Live Session Catalog.

    ]]>     Get ready for Cisco Live next week in Vegas with a quick primer on everything Talos has going on at the conference. We’re excited to be back in person interacting with customers and users. Jon has a complete rundown of the Talos space at the conference, some talk highlights and other things you should know before you go. For a complete agenda, check out the Cisco Live Session Catalog.

    ]]>     Jon Munshaw (host) and Alexis Merritt (speaker) https://www.talosintelligence.com/podcasts/652 Fri, 12 Aug 2022 12:00:00 -0400 331 conferences, news, Cisco Live full false     Talos Takes Ep. #99: A primer on Talos at RSA Talos Takes Ep. #99: A primer on Talos at RSA We’re doing something a bit different this week — it’s just Jon for a few minutes talking about Talos’ plans at the RSA Conference coming up next week. Catch up on our plans for the week and here about some special events we have planned. To stay up-to-date on the latest, follow us on Twitter. And if you prefer a written preview, read this week’s Threat Source newsletter.

    ]]>     We’re doing something a bit different this week — it’s just Jon for a few minutes talking about Talos’ plans at the RSA Conference coming up next week. Catch up on our plans for the week and here about some special events we have planned. To stay up-to-date on the latest, follow us on Twitter. And if you prefer a written preview, read this week’s Threat Source newsletter.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/650 Fri, 12 Aug 2022 12:00:00 -0400 280 conferences, RSA, RSAC, podcasts full false     Talos Takes Ep. #98: Maybe don't panic about that F5 BIG-IP vulnerability Talos Takes Ep. #98: Maybe don't panic about that F5 BIG-IP vulnerability The recently disclosed vulnerability in F5 BIG-IP took security Twitter by storm two weeks ago, and continues to make headlines now. It immediately prompted warnings from CISA and security researchers everywhere warning users to patch as soon as possible. Of course, it’s important to patch. But maybe we started panicking a little too early that this was going to be the next PrintNightmare. On this week’s episode of Talos Takes, Jon is joined by Jerry Gamblin from Kenna Security to talk about the ins and outs of this vulnerability and while it is serious, it’s incredibly unlikely that an attacker can or would exploit it in the wild.

    ]]>     The recently disclosed vulnerability in F5 BIG-IP took security Twitter by storm two weeks ago, and continues to make headlines now. It immediately prompted warnings from CISA and security researchers everywhere warning users to patch as soon as possible. Of course, it’s important to patch. But maybe we started panicking a little too early that this was going to be the next PrintNightmare. On this week’s episode of Talos Takes, Jon is joined by Jerry Gamblin from Kenna Security to talk about the ins and outs of this vulnerability and while it is serious, it’s incredibly unlikely that an attacker can or would exploit it in the wild.

    ]]>     Jon Munshaw (host) and Jerry Gamblin (speaker) https://www.talosintelligence.com/podcasts/649 Fri, 12 Aug 2022 12:00:00 -0400 487 vulnerabilities, patching, Kenna, BIG-IP full false     Talos Takes Ep. #97: MustangPanda stays agnostic Talos Takes Ep. #97: MustangPanda stays agnostic See people, this is what happens when you finally let a panda drive a sports car! This week’s episode of Talos Takes covers the basics of MustangPanda, a Chinese state-sponsored actor we wrote about recently. Asheer Maholtra joins the show to go over his research into this group. Mainly, we discuss why this actor, despite being aligned with China, is targeting Russian government entities and organizations. Though the two countries seem to be allies, all is fair in love and cyber espionage.

    ]]>     See people, this is what happens when you finally let a panda drive a sports car! This week’s episode of Talos Takes covers the basics of MustangPanda, a Chinese state-sponsored actor we wrote about recently. Asheer Maholtra joins the show to go over his research into this group. Mainly, we discuss why this actor, despite being aligned with China, is targeting Russian government entities and organizations. Though the two countries seem to be allies, all is fair in love and cyber espionage.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/648 Fri, 12 Aug 2022 12:00:00 -0400 480 MustangPanda, APTs, state-sponsored, ransomware, trojans full false     Talos Takes Ep. #96: Takeaways from victim chats with two ransomware groups Talos Takes Ep. #96: Takeaways from victim chats with two ransomware groups Kendall McKay joins Jon this week to discuss the Hive and Conti ransomware chats she and her colleagues recently reviewed. We obtained some leaked chats between these ransomware groups and some of their victims, showing us what communicating with an attacker is really like. Jon and Kendall discuss the negotiation process over a ransom payment and what else we learned from these chat logs.

    ]]>     Kendall McKay joins Jon this week to discuss the Hive and Conti ransomware chats she and her colleagues recently reviewed. We obtained some leaked chats between these ransomware groups and some of their victims, showing us what communicating with an attacker is really like. Jon and Kendall discuss the negotiation process over a ransom payment and what else we learned from these chat logs.

    ]]>     Jon Munshaw (host) and Kendall McKay (speaker) https://www.talosintelligence.com/podcasts/615 Fri, 12 Aug 2022 12:00:00 -0400 706 Hive, Conti, ransomware, malware full false     Talos Takes Ep. #95 (XL Edition): CTIR recaps last quarter's top threats Talos Takes Ep. #95 (XL Edition): CTIR recaps last quarter's top threats On this week’s episode of Talos Takes, we’re bringing you the recording of last week’s live stream with Cisco Talos Incident Response. Beers with Talos’ own Liz Waddell hosted the first in our new “On Air” series with CTIR, where she and her fellow Talosians recapped the previous quarter’s top threats. They run through the malware families CTIR saw most in the field and discussed other trends that threat actors are starting to adapt.

    ]]>     On this week’s episode of Talos Takes, we’re bringing you the recording of last week’s live stream with Cisco Talos Incident Response. Beers with Talos’ own Liz Waddell hosted the first in our new “On Air” series with CTIR, where she and her fellow Talosians recapped the previous quarter’s top threats. They run through the malware families CTIR saw most in the field and discussed other trends that threat actors are starting to adapt.

    ]]>     Liz Waddell (host), Caitlin Huey (speaker), Alexis Merritt (speaker), and Laurie Varner (speaker) https://www.talosintelligence.com/podcasts/609 Fri, 12 Aug 2022 12:00:00 -0400 2356 CTIR, Incident Response, ransomware, malware full false     Talos Takes Ep. #94: Everything you need to know about the BlackCat ransomware group Talos Takes Ep. #94: Everything you need to know about the BlackCat ransomware group BlackCat, BlackMatter, DarkSide, BlackByte…it’s too hard to keep up with all these ransomware group names these days. So we’re here to break down one of these groups, BlackCat, for you so you can figure out what makes them actually memorable. Aliza Berk from our Talos Threat Intelligence & Interdiction team joins Jon Munshaw this week to talk about BlackCat and their ransomware that’s recently become a major player on the malware landscape. Aliza recently compiled our latest Threat Assessment Report on this group and assisted in our research around the group. Jon and Aliza discuss how the use of the Rust programming language and using triple extortion tactics make this group a threat.

    ]]>     BlackCat, BlackMatter, DarkSide, BlackByte…it’s too hard to keep up with all these ransomware group names these days. So we’re here to break down one of these groups, BlackCat, for you so you can figure out what makes them actually memorable. Aliza Berk from our Talos Threat Intelligence & Interdiction team joins Jon Munshaw this week to talk about BlackCat and their ransomware that’s recently become a major player on the malware landscape. Aliza recently compiled our latest Threat Assessment Report on this group and assisted in our research around the group. Jon and Aliza discuss how the use of the Rust programming language and using triple extortion tactics make this group a threat.

    ]]>     Jon Munshaw (host) and Aliza Berk (speaker) https://www.talosintelligence.com/podcasts/608 Fri, 12 Aug 2022 12:00:00 -0400 499 BlackCat, ransomware, BlackMatter, malware, APTs full false     Talos Takes Ep. #93: Kenna 101 — Best patching and mitigation strategies Talos Takes Ep. #93: Kenna 101 — Best patching and mitigation strategies Continuing the “Kenna 101” series over at Talos Takes, Ed Bellis re-joins the show to talk about patching and mitigation strategies. So far, we’ve talked about how to tell when you should take a CVE seriously. But what if there’s no patch for it? Or what if you have to patch 50 vulnerabilities in the same product? We talk about how Kenna can help security teams of all sizes prioritize their patching strategies and create mitigation strategies in the worst-case scenario. For the other entries in our Kenna 101 series, listen here and here.

    ]]>     Continuing the “Kenna 101” series over at Talos Takes, Ed Bellis re-joins the show to talk about patching and mitigation strategies. So far, we’ve talked about how to tell when you should take a CVE seriously. But what if there’s no patch for it? Or what if you have to patch 50 vulnerabilities in the same product? We talk about how Kenna can help security teams of all sizes prioritize their patching strategies and create mitigation strategies in the worst-case scenario. For the other entries in our Kenna 101 series, listen here and here.

    ]]>     Jon Munshaw (host) and Ed Bellis (speaker) https://www.talosintelligence.com/podcasts/607 Fri, 12 Aug 2022 12:00:00 -0400 571 vulnerabilities, patching, Kenna Security, vulnerability research full false     Talos Takes Ep. #92: Kenna 101 — How to read a CVE Talos Takes Ep. #92: Kenna 101 — How to read a CVE Continuing our “Kenna 101” series, Jon is joined this week by Jerry Gamblin, Kenna’s director of security research. Jerry is an expert at all things CVE’s, so we reflect on reading vulnerability reports and analyzing specific CVEs. We discuss if “severity” scores even really mean anything, and how to interpret a maximum 10/10 score versus an attacker vector or type of vulnerability.

    ]]>     Continuing our “Kenna 101” series, Jon is joined this week by Jerry Gamblin, Kenna’s director of security research. Jerry is an expert at all things CVE’s, so we reflect on reading vulnerability reports and analyzing specific CVEs. We discuss if “severity” scores even really mean anything, and how to interpret a maximum 10/10 score versus an attacker vector or type of vulnerability.

    ]]>     Jon Munshaw (host) and Jerry Gamblin (speaker) https://www.talosintelligence.com/podcasts/605 Fri, 12 Aug 2022 12:00:00 -0400 596 Kenna, vulnerabilities, patching, exploits, full false     Talos Takes Ep. #91: The tax scams cometh Talos Takes Ep. #91: The tax scams cometh It’s tax season! You know what that means — sadness, frustration and scams. Host Jon Munshaw sat down with Nick Biasini from the Talos Outreach team to talk about common tactics adversaries use around this “holiday” to try and spread malware, steal personal information and take users’ money. We talk about free security tools you can deploy to block these types of threats, common spam tactics to keep an eye out for and other services that can help you prepare for a worst-case scenario.

    ]]>     It’s tax season! You know what that means — sadness, frustration and scams. Host Jon Munshaw sat down with Nick Biasini from the Talos Outreach team to talk about common tactics adversaries use around this “holiday” to try and spread malware, steal personal information and take users’ money. We talk about free security tools you can deploy to block these types of threats, common spam tactics to keep an eye out for and other services that can help you prepare for a worst-case scenario.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/604 Fri, 12 Aug 2022 12:00:00 -0400 369 tax, Tax Day, spam, scams, email full false     Talos Takes Ep. #90: Kenna Security 101 Talos Takes Ep. #90: Kenna Security 101 We’re kicking off a new series of episodes called “Kenna 101” highlighting Cisco’s newest partner, Kenna Security. Kenna is a risk management platform for vulnerabilities that allows users to view what vulnerabilities exist in their environment and helps them create a plan for patching and mitigation. We’re starting things off with the CTO of Kenna, Ed Bellis, to talk about the basics of Kenna and its risk scores.

    ]]>     We’re kicking off a new series of episodes called “Kenna 101” highlighting Cisco’s newest partner, Kenna Security. Kenna is a risk management platform for vulnerabilities that allows users to view what vulnerabilities exist in their environment and helps them create a plan for patching and mitigation. We’re starting things off with the CTO of Kenna, Ed Bellis, to talk about the basics of Kenna and its risk scores.

    ]]>     Jon Munshaw (host) and Ed Bellis (speaker) https://www.talosintelligence.com/podcasts/603 Fri, 12 Aug 2022 12:00:00 -0400 596 Kenna, security, vulnerabilities, patching full false     Talos Takes Ep. #89: Taking the Meta out of the Metaverse Talos Takes Ep. #89: Taking the Meta out of the Metaverse When most people think of the “Metaverse,” they may first think of the company Meta — the recently rebranded Facebook. After all, what other company would really want everyone taking meetings virtually using avatars while you share your cryptocurrency wallets and personal information with them? The Metaverse is actually much larger than this, though. So in this Talos Takes episode, we’re trying to demystify the Metaverse and look at what it is, exactly. Researcher Jaeson Schultz recaps his recent blog post on the matter, and then he and Jon talk about the potential security pitfalls that could arise from adopting the Metaverse.

    ]]>     When most people think of the “Metaverse,” they may first think of the company Meta — the recently rebranded Facebook. After all, what other company would really want everyone taking meetings virtually using avatars while you share your cryptocurrency wallets and personal information with them? The Metaverse is actually much larger than this, though. So in this Talos Takes episode, we’re trying to demystify the Metaverse and look at what it is, exactly. Researcher Jaeson Schultz recaps his recent blog post on the matter, and then he and Jon talk about the potential security pitfalls that could arise from adopting the Metaverse.

    ]]>     Jon Munshaw (host) and Jaeson Schultz (speaker) https://www.talosintelligence.com/podcasts/601 Fri, 12 Aug 2022 12:00:00 -0400 741 Metaverse, Meta, cryptocurrency, scams full false     Talos Takes Ep. #88: Biden's crypto executive order is good for good guys and bad for bad guys Talos Takes Ep. #88: Biden's crypto executive order is good for good guys and bad for bad guys Jon and Nick sit down for a few minutes to talk about U.S. President Joe Biden’s recent Executive Order on more heavily regulating cryptocurrency. For a primer on this episode, you can read a quick overview here. This episode pretty much sums it up as being a good thing for anyone who uses cryptocurrency legitimately, and bad for anyone who uses crypto to do anything illegal. We discuss how greater regulation could affect ransomware operators who rely on virtual currency for ransom payments and illegitimate miners, and why no one using Bitcoin legitimately should be worried.

    ]]>     Jon and Nick sit down for a few minutes to talk about U.S. President Joe Biden’s recent Executive Order on more heavily regulating cryptocurrency. For a primer on this episode, you can read a quick overview here. This episode pretty much sums it up as being a good thing for anyone who uses cryptocurrency legitimately, and bad for anyone who uses crypto to do anything illegal. We discuss how greater regulation could affect ransomware operators who rely on virtual currency for ransom payments and illegitimate miners, and why no one using Bitcoin legitimately should be worried.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/600 Fri, 12 Aug 2022 12:00:00 -0400 431 cryptocurrency, cryptominers, ransomware, ransom, government full false     Talos Takes Ep. #87 (XL Edition): Livestream update on the current cybersecurity situation in Ukraine Talos Takes Ep. #87 (XL Edition): Livestream update on the current cybersecurity situation in Ukraine Cisco Talos threat intelligence team and Cisco ThousandEyes went live on Talos’ social media platforms Friday to provide guidance on current cyberattacks and insight into internet activity in Ukraine. Both teams are actively monitoring the digital landscape and openly sharing essential findings to contribute to the safety of our customers globally.

    Many of our teams have set aside normal tasks, now spending their time watching over Ukrainian networks. Other teams have focused on protecting refugees, physically and digitally. Still, others have volunteered their free time contributing critical components to our open-source intelligence work. The audio version of this briefing will share what we have seen and how you can protect your data, network and teams.

    ]]>     Cisco Talos threat intelligence team and Cisco ThousandEyes went live on Talos’ social media platforms Friday to provide guidance on current cyberattacks and insight into internet activity in Ukraine. Both teams are actively monitoring the digital landscape and openly sharing essential findings to contribute to the safety of our customers globally.

    Many of our teams have set aside normal tasks, now spending their time watching over Ukrainian networks. Other teams have focused on protecting refugees, physically and digitally. Still, others have volunteered their free time contributing critical components to our open-source intelligence work. The audio version of this briefing will share what we have seen and how you can protect your data, network and teams.

    ]]>     Amy Henderson (speaker), Hazel Burton (host), and JJ Cummings (speaker) https://www.talosintelligence.com/podcasts/597 Fri, 12 Aug 2022 12:00:00 -0400 3258 Ukraine,cyberwar,cybersecurity,cyberattack,APTs full false     Talos Takes Ep. #86: The fallout from the recent REvil arrests Talos Takes Ep. #86: The fallout from the recent REvil arrests In the latest entry in the “Days of our Ransomware” series, Azim Khodjibaev joins Jon to talk about some recent ransomware drama. Dark web forums have been going nuts since Russia arrested and charged several alleged members of the REvil ransomware gang in January. Azim discusses how there’s been a power grab since those arrests, and we discuss what else it might take to shut down many of these wide-reaching ransomware groups. Threat actors: They get into the same petty arguments we all do in Slack.

    ]]>     In the latest entry in the “Days of our Ransomware” series, Azim Khodjibaev joins Jon to talk about some recent ransomware drama. Dark web forums have been going nuts since Russia arrested and charged several alleged members of the REvil ransomware gang in January. Azim discusses how there’s been a power grab since those arrests, and we discuss what else it might take to shut down many of these wide-reaching ransomware groups. Threat actors: They get into the same petty arguments we all do in Slack.

    ]]>     Jon Munshaw (host) and Azim Khodjibaev (speaker) https://www.talosintelligence.com/podcasts/596 Fri, 12 Aug 2022 12:00:00 -0400 536 ransomware, APTs, RaaS, state-sponsored actors full false     Talos Takes Ep. #85: ICS as it relates to the current situation in Ukraine Talos Takes Ep. #85: ICS as it relates to the current situation in Ukraine As the Ukraine situation evolves, we figured it was an important time to check in with the specific threats government agencies across the globe have started to warn us about. Joe Marshall, Talos’ resident industrial control systems expert, joins this week’s episode of Talos Takes to talk about potential threats to Ukraine’s power grid should kinetic warfare break out in the area. We also touch on what potential threats America’s infrastructure faces if our government leaders were to oppose any Russian actions in the region. It’s admittedly a tangled web currently — but for the most current information on this, check out the Talos blog on the topic.

    ]]>     As the Ukraine situation evolves, we figured it was an important time to check in with the specific threats government agencies across the globe have started to warn us about. Joe Marshall, Talos’ resident industrial control systems expert, joins this week’s episode of Talos Takes to talk about potential threats to Ukraine’s power grid should kinetic warfare break out in the area. We also touch on what potential threats America’s infrastructure faces if our government leaders were to oppose any Russian actions in the region. It’s admittedly a tangled web currently — but for the most current information on this, check out the Talos blog on the topic.

    ]]>     Jon Munshaw (host) and Joe Marshall (speaker) https://www.talosintelligence.com/podcasts/562 Fri, 12 Aug 2022 12:00:00 -0400 627 Ukraine, ICS, infrastructure, cyberwarfare full false     Talos Takes Ep. #84: Commodity RATs 101 Talos Takes Ep. #84: Commodity RATs 101 What’s a commodity RAT? And how does that make it different from your run-of-the-mill RAT? Is that RAT different than a trojan? In this week’s Talos Takes episode, we answer these questions and more to provide you a quick overview of remote access trojans/tools (aka RATs) and how commodity RATS specifically differ from their “normal” brethren. Asheer Malhotra from our Outreach team has been looking at several commodity RATs for months now and is here to take you to class for 10 minutes.

    ]]>     What’s a commodity RAT? And how does that make it different from your run-of-the-mill RAT? Is that RAT different than a trojan? In this week’s Talos Takes episode, we answer these questions and more to provide you a quick overview of remote access trojans/tools (aka RATs) and how commodity RATS specifically differ from their “normal” brethren. Asheer Malhotra from our Outreach team has been looking at several commodity RATs for months now and is here to take you to class for 10 minutes.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/561 Fri, 12 Aug 2022 12:00:00 -0400 564 RATs, trojans, malware, cybersecurity basics full false     Talos Takes Ep. #83: The latest on the cybersecurity situation in Ukraine Talos Takes Ep. #83: The latest on the cybersecurity situation in Ukraine Jon Munshaw and Nick Biasini sit down for a few minutes to discuss the latest on the ongoing cyber attacks and security concerns in Ukraine. They discuss how a recent set of attacks against government-run websites compares to past attacks like NotPetya, and provide guidance for any companies who may be based in, or do business in, Ukraine. For more of Talos’ insight on this, please continue to check back on our blog post here.

    ]]>     Jon Munshaw and Nick Biasini sit down for a few minutes to discuss the latest on the ongoing cyber attacks and security concerns in Ukraine. They discuss how a recent set of attacks against government-run websites compares to past attacks like NotPetya, and provide guidance for any companies who may be based in, or do business in, Ukraine. For more of Talos’ insight on this, please continue to check back on our blog post here.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/560 Fri, 12 Aug 2022 12:00:00 -0400 367 NotPetya, Ukraine, Russia, full false     Talos Takes Ep. #82: Log4j followed us into 2022 Talos Takes Ep. #82: Log4j followed us into 2022 We thought it was usually all about “New year, new me,” heading into 2022, but turns out it’s the same cybersecurity problems. Join host Jon Munshaw as he welcomes on threat researcher JJ Cummings to discuss how the Log4j vulnerability event evolved over the holiday break. JJ, who you may recognized from our recent live Beers with Talos episode, discusses the new CVE that popped up the week after Christmas, and then discusses what things he and his team will be looking into regarding Log4shell in 2022.

    ]]>     We thought it was usually all about “New year, new me,” heading into 2022, but turns out it’s the same cybersecurity problems. Join host Jon Munshaw as he welcomes on threat researcher JJ Cummings to discuss how the Log4j vulnerability event evolved over the holiday break. JJ, who you may recognized from our recent live Beers with Talos episode, discusses the new CVE that popped up the week after Christmas, and then discusses what things he and his team will be looking into regarding Log4shell in 2022.

    ]]>     Jon Munshaw (host) and JJ Cummings (speaker) https://www.talosintelligence.com/podcasts/558 Fri, 12 Aug 2022 12:00:00 -0400 545 Log4j, vulnerabilities, Log4shell full false     Talos Takes Ep. #81 (XL Edition): Log4J roundtable Talos Takes Ep. #81 (XL Edition): Log4J roundtable This is a special XL edition of Talos Takes that is a replay of a live stream our amazing researchers put on earlier this week. You’ll hear Matt Olney, Amy Henderson and Vitor Ventura, all from Talos, talk about the Log4J vulnerability that is ruining the internet for everyone right now. They discussed the latest news around the vulnerability, provided advice to users who may be affected (i.e., pretty much everyone) and looked at where we go from here. If you’d like to hear more from us, you can join us LIVE on all of our social media platforms at noon ET on Friday, Dec. 17 for a special episode of Beers with Talos, where we’ll have more updates on Log4J.

    ]]>     This is a special XL edition of Talos Takes that is a replay of a live stream our amazing researchers put on earlier this week. You’ll hear Matt Olney, Amy Henderson and Vitor Ventura, all from Talos, talk about the Log4J vulnerability that is ruining the internet for everyone right now. They discussed the latest news around the vulnerability, provided advice to users who may be affected (i.e., pretty much everyone) and looked at where we go from here. If you’d like to hear more from us, you can join us LIVE on all of our social media platforms at noon ET on Friday, Dec. 17 for a special episode of Beers with Talos, where we’ll have more updates on Log4J.

    ]]>     Matt Olney (speaker), Amy Henderson (speaker), Jon Munshaw (host), and Vitor Ventura (speaker) https://www.talosintelligence.com/podcasts/552 Fri, 12 Aug 2022 12:00:00 -0400 1976 Log4J, vulnerabilities, patching, malware, threats full false     Talos Takes Ep. #80: I'll have a blue Christmas without a CTIR retainer Talos Takes Ep. #80: I'll have a blue Christmas without a CTIR retainer We had to give Brad a few minutes to take an Incident Response victory lap after his team received two major accolades over the past two weeks. But aside from that, it’s also a perfect time to have him on ahead of the holidays. The shopping season is always a favorite time for attackers, so it’s as good a time as any to make sure your incident response plan is polished and practiced. We also take some time to look back on what Incident Response lessons Brad learned in 2021.

    ]]>     We had to give Brad a few minutes to take an Incident Response victory lap after his team received two major accolades over the past two weeks. But aside from that, it’s also a perfect time to have him on ahead of the holidays. The shopping season is always a favorite time for attackers, so it’s as good a time as any to make sure your incident response plan is polished and practiced. We also take some time to look back on what Incident Response lessons Brad learned in 2021.

    ]]>     Jon Munshaw (host) and Brad Garnett (speaker) https://www.talosintelligence.com/podcasts/548 Fri, 12 Aug 2022 12:00:00 -0400 540 incident response, spam, scams, holiday shopping, news full false     Talos Takes Ep. #79: Could Emotet be back? Talos Takes Ep. #79: Could Emotet be back? Emotet was about a month late for Halloween, because it’s got its zombie costume on. The long-known botnet is showing some signs of life in late 2021 after an international law enforcement takedown earlier this year. Nick Biasini joins Talos Takes this week to discuss what signs we’re seeing to indicate Emotet’s return, and provides some advice as to what we should look out for as we head into 2022.

    ]]>     Emotet was about a month late for Halloween, because it’s got its zombie costume on. The long-known botnet is showing some signs of life in late 2021 after an international law enforcement takedown earlier this year. Nick Biasini joins Talos Takes this week to discuss what signs we’re seeing to indicate Emotet’s return, and provides some advice as to what we should look out for as we head into 2022.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/515 Fri, 12 Aug 2022 12:00:00 -0400 305 Emotet, botnet, spam, email full false     Talos Takes Ep. #78: Attackers know you are still looking for a PS5 this holiday season Talos Takes Ep. #78: Attackers know you are still looking for a PS5 this holiday season We know, we know. We do one of these every year. But people still falling for scams, so we still have to keep reminding people how to shop safely online! This year is a bit different than past Black Fridays and Cyber Mondays because of the issues around the supply chain. Attackers are sure to try to convince you that the big gift you want this year won’t arrive on time so you have to “ACT NOW!” Plus, there’s the continued frenzy to find PlayStation 5s and XBOX Series X/S’s. Jon and Nick talk about scams you’re likely to see while shopping online over the long weekend and provide some helpful tips that anyone can use.

    ]]>     We know, we know. We do one of these every year. But people still falling for scams, so we still have to keep reminding people how to shop safely online! This year is a bit different than past Black Fridays and Cyber Mondays because of the issues around the supply chain. Attackers are sure to try to convince you that the big gift you want this year won’t arrive on time so you have to “ACT NOW!” Plus, there’s the continued frenzy to find PlayStation 5s and XBOX Series X/S’s. Jon and Nick talk about scams you’re likely to see while shopping online over the long weekend and provide some helpful tips that anyone can use.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/514 Fri, 12 Aug 2022 12:00:00 -0400 316 Black Friday, Cyber Monday, shopping, e-commerce, scams, spam full false     Talos Takes Ep. #72: Emergency Apache HTTP Server episode Talos Takes Ep. #72: Emergency Apache HTTP Server episode Sorry for dropping two episodes in the feed in one day, but we also needed to find time to talk about the critical zero-day vulnerability in Apache HTTP Server. An attacker could exploit this vulnerability to perform path traversal and eventually remote code execution. Patch for this one as soon as possible, and use the Snort rule we have available now.

    ]]>     Sorry for dropping two episodes in the feed in one day, but we also needed to find time to talk about the critical zero-day vulnerability in Apache HTTP Server. An attacker could exploit this vulnerability to perform path traversal and eventually remote code execution. Patch for this one as soon as possible, and use the Snort rule we have available now.

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/505 Fri, 12 Aug 2022 12:00:00 -0400 305 Apache, patching, vulnerabilities, full false     Talos Takes Ep. #77: How to safely connect to (and use) public WiFi Talos Takes Ep. #77: How to safely connect to (and use) public WiFi For the first time in Talos Takes’ history, we have a formal crossover with Beers with Talos. Mitch Neff, the host of BWT, joins the show to talk about his horror stories using public WiFi networks. He and Jon discuss the safest ways to interact with large, public network in places like libraries, parks and airports, and potential alternatives to public hotspots.

    ]]>     For the first time in Talos Takes’ history, we have a formal crossover with Beers with Talos. Mitch Neff, the host of BWT, joins the show to talk about his horror stories using public WiFi networks. He and Jon discuss the safest ways to interact with large, public network in places like libraries, parks and airports, and potential alternatives to public hotspots.

    ]]>     Mitch Neff (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/511 Fri, 12 Aug 2022 12:00:00 -0400 520 WiFi, cybersecurity, tips, cybersecurity basics full false     Talos Takes Ep. #76: What type of secrets could Kimsuky be after? Talos Takes Ep. #76: What type of secrets could Kimsuky be after? Jon took a break from listening to “Red (Taylor’s Version)” to turn this podcast around quickly to align with our recent research on the Kimsuky APT. This North Korean state-sponsored actor is in the wild again targeting South Korean organizations that house potentially sensitive information. The group set up fake Blogger sites to lure in the victims to read about news related to nuclear disarmament and relations on the Korean peninsula, but instead were hit with infostealing malware. Assheer Malhotra, who helped research and write our latest blog, joins the show to discuss this group’s motivations, what information they may have been looking for, and how Talos helped put a stop to their actions.

    ]]>     Jon took a break from listening to “Red (Taylor’s Version)” to turn this podcast around quickly to align with our recent research on the Kimsuky APT. This North Korean state-sponsored actor is in the wild again targeting South Korean organizations that house potentially sensitive information. The group set up fake Blogger sites to lure in the victims to read about news related to nuclear disarmament and relations on the Korean peninsula, but instead were hit with infostealing malware. Assheer Malhotra, who helped research and write our latest blog, joins the show to discuss this group’s motivations, what information they may have been looking for, and how Talos helped put a stop to their actions.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/510 Fri, 12 Aug 2022 12:00:00 -0400 496 Kimsuky, malware, APTs, state-sponsored, spam full false     Talos Takes Ep. #75 (XL Edition): Building the perfect Incident Response Plan Talos Takes Ep. #75 (XL Edition): Building the perfect Incident Response Plan We have another special extra large-sized version of Talos Takes this week. Enjoy this recording of a live stream we hosted earlier this week with Martin Lee from our Talos Communications team and Paul Lee from Cisco Talos Incident Response. The Lees discuss how to build the perfect Incident Response Plan. First, Martin walks through the basics of creating, editing and iterating on an IR plan. Then, he’s joined by Paul to ask him a few questions, take some Q&A from the audience and learn about Paul’s experience from the field.

    ]]>     We have another special extra large-sized version of Talos Takes this week. Enjoy this recording of a live stream we hosted earlier this week with Martin Lee from our Talos Communications team and Paul Lee from Cisco Talos Incident Response. The Lees discuss how to build the perfect Incident Response Plan. First, Martin walks through the basics of creating, editing and iterating on an IR plan. Then, he’s joined by Paul to ask him a few questions, take some Q&A from the audience and learn about Paul’s experience from the field.

    ]]>     Mitch Neff (host) and Martin Lee (speaker) https://www.talosintelligence.com/podcasts/509 Fri, 12 Aug 2022 12:00:00 -0400 2951 incident response, IR, incident response plan, CTIR full false     Talos Takes Ep. #74 (NCSAM Edition AND XL Edition): Q&A session with Talos Incident Response Talos Takes Ep. #74 (NCSAM Edition AND XL Edition): Q&A session with Talos Incident Response This is a double special Talos Takes episode — it’s XL-sized and continues our Cybersecurity Awareness Month theme. This is a recording of our live stream from earlier this week with Brad Garnett, the general manager of Talos Incident Response. Even if you’ve never worked with an incident response team before, or have no idea what IR is, this is a perfect place to start. We provide the tl;dr of the IR process, talk building an IR plan and answer audience questions.

    ]]>     This is a double special Talos Takes episode — it’s XL-sized and continues our Cybersecurity Awareness Month theme. This is a recording of our live stream from earlier this week with Brad Garnett, the general manager of Talos Incident Response. Even if you’ve never worked with an incident response team before, or have no idea what IR is, this is a perfect place to start. We provide the tl;dr of the IR process, talk building an IR plan and answer audience questions.

    ]]>     Jon Munshaw (host) and Brad Garnett (speaker) https://www.talosintelligence.com/podcasts/508 Fri, 12 Aug 2022 12:00:00 -0400 2663 incident response, CTIR, IR, ransomware, hybrid work full false     Talos Takes Ep. #73 (NCSAM edition): Fight back against the phish Talos Takes Ep. #73 (NCSAM edition): Fight back against the phish We continue our special series for National Cybersecurity Awareness Month by addressing everyone’s worst nightmare: phish. Who among us hasn’t gotten the call, “We’re trying to reach out about your car’s extended warranty?” In this Talos Takes, Jaeson Schultz, Talos’ foremost spam and phish expert, breaks down spam emails, phone calls and messages for any user. We discuss new trends we’re seeing from attackers in 2021, talk about the best software solutions available and give advice to Jon’s 77-year-old grandmother.

    ]]>     We continue our special series for National Cybersecurity Awareness Month by addressing everyone’s worst nightmare: phish. Who among us hasn’t gotten the call, “We’re trying to reach out about your car’s extended warranty?” In this Talos Takes, Jaeson Schultz, Talos’ foremost spam and phish expert, breaks down spam emails, phone calls and messages for any user. We discuss new trends we’re seeing from attackers in 2021, talk about the best software solutions available and give advice to Jon’s 77-year-old grandmother.

    ]]>     Jon Munshaw (host) and Jaeson Schultz (speaker) https://www.talosintelligence.com/podcasts/506 Fri, 12 Aug 2022 12:00:00 -0400 635 spam, phishing, spear-phishing, email full false     Talos Takes Ep. #71 (NCSAM Edition): 2021 in ransomware Talos Takes Ep. #71 (NCSAM Edition): 2021 in ransomware We are from the first (or last) people to say this, but 2021 is the year of ransomware. It’s by far the biggest story on the security landscape right now. And everything from oil pipelines, to grain co-ops, to hospitals and schools have been targeted by ransomware this year. Azim Khodjibaev joins the show for National Cybersecurity Awareness Month to wrap up everything we’ve seen on the ransomware landscape this year. Azim reflects on his interview with a LockBit operator, the research he’s done into “double extortion campaigns,” and discusses the lessons defenders can learn from the past 10 months.

    ]]>     We are from the first (or last) people to say this, but 2021 is the year of ransomware. It’s by far the biggest story on the security landscape right now. And everything from oil pipelines, to grain co-ops, to hospitals and schools have been targeted by ransomware this year. Azim Khodjibaev joins the show for National Cybersecurity Awareness Month to wrap up everything we’ve seen on the ransomware landscape this year. Azim reflects on his interview with a LockBit operator, the research he’s done into “double extortion campaigns,” and discusses the lessons defenders can learn from the past 10 months.

    ]]>     Jon Munshaw (host) and Azim Khodjibaev (speaker) https://www.talosintelligence.com/podcasts/504 Fri, 12 Aug 2022 12:00:00 -0400 417 ransomware, cybersecurity, extortion, ransom, cyber attacks full false     Talos Takes Ep. #70 (NCSAM edition): For once, a positive spin on hybrid work Talos Takes Ep. #70 (NCSAM edition): For once, a positive spin on hybrid work Everyone loves to talk and write about how tough it is that we are all working remotely during the COVID-19 pandemic. So for once — to celebrate National Cybersecurity Awareness Month — Talos Takes wants to talk about the positives! Christopher Marshall, the head of Talos’ detection research team, joins the show to discuss how he’s kept his team’s morale up during this time. Cybersecurity is a rough industry to be in, regardless of any external factors. So it’s important for him to avoid employee burnout and turnover. He and Jon also discuss the positives of working remotely, what they’re most looking forward to when they can go back into the office and their favorite pandemic-era hobbies.

    ]]>     Everyone loves to talk and write about how tough it is that we are all working remotely during the COVID-19 pandemic. So for once — to celebrate National Cybersecurity Awareness Month — Talos Takes wants to talk about the positives! Christopher Marshall, the head of Talos’ detection research team, joins the show to discuss how he’s kept his team’s morale up during this time. Cybersecurity is a rough industry to be in, regardless of any external factors. So it’s important for him to avoid employee burnout and turnover. He and Jon also discuss the positives of working remotely, what they’re most looking forward to when they can go back into the office and their favorite pandemic-era hobbies.

    ]]>     Jon Munshaw (host) and Christopher Marshall (speaker) https://www.talosintelligence.com/podcasts/503 Fri, 12 Aug 2022 12:00:00 -0400 562 work from home, COVID, burnout, hiring, security full false     Talos Takes Ep. #69: Our armadillo in shining armor Talos Takes Ep. #69: Our armadillo in shining armor Asheer Malhotra joins the show to once again cover a cyber attack in South Asia. This time, it’s an attacker that looks and smells like an APT, but may just be a run-of-the-mill crimeware gang. Asheer discusses he and his colleagues’ research into Operation: Armor Piercer, a campaign targeted at government agencies and military contractors. Needless to say, these are high-profile targets. Find out what this group wants and why they’re aping so much from other groups like Transparent Tribe and SideCopy.

    ]]>     Asheer Malhotra joins the show to once again cover a cyber attack in South Asia. This time, it’s an attacker that looks and smells like an APT, but may just be a run-of-the-mill crimeware gang. Asheer discusses he and his colleagues’ research into Operation: Armor Piercer, a campaign targeted at government agencies and military contractors. Needless to say, these are high-profile targets. Find out what this group wants and why they’re aping so much from other groups like Transparent Tribe and SideCopy.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/502 Fri, 12 Aug 2022 12:00:00 -0400 600 RATs, malware, APTs, spam, MFA full false     Talos Takes Ep. #68: It's a bird, it's a plane, it's some rats! Talos Takes Ep. #68: It's a bird, it's a plane, it's some rats! Allow Vitor Ventura to take you on a journey of discovery, threat actors and attribution. He recently assisted with an investigation into a series of malware and spam campaigns using aviation-themed lures. These include fake flight itineraries, invoices and more. Vitor joins us on this week’s Talos Takes episode to discuss what he learned during this process, including how he connected the campaigns, what he learned (and couldn’t learn) about the actor behind them, and what he’ll take away into his next research. This is a great episode for anyone who is wondering about what kinds of pitfalls are out there for a security researcher.

    ]]>     Allow Vitor Ventura to take you on a journey of discovery, threat actors and attribution. He recently assisted with an investigation into a series of malware and spam campaigns using aviation-themed lures. These include fake flight itineraries, invoices and more. Vitor joins us on this week’s Talos Takes episode to discuss what he learned during this process, including how he connected the campaigns, what he learned (and couldn’t learn) about the actor behind them, and what he’ll take away into his next research. This is a great episode for anyone who is wondering about what kinds of pitfalls are out there for a security researcher.

    ]]>     Jon Munshaw (host) and Vitor Ventura (speaker) https://www.talosintelligence.com/podcasts/501 Fri, 12 Aug 2022 12:00:00 -0400 377 malware, spam, email full false     Talos Takes Ep. #67: Why are ransomware groups getting so emotional? Talos Takes Ep. #67: Why are ransomware groups getting so emotional? Fresh off of translating an entire ransomware playbook from Russian to English, Azim and Dave from the Talos Threat Intelligence & Interdiction team join Talos Takes to talk about this project. They provide some first-hand insights into what this leaked playbook tells us about the Conti ransomware-as-a-service group. Threat actors — they have feelings just like us!

    ]]>     Fresh off of translating an entire ransomware playbook from Russian to English, Azim and Dave from the Talos Threat Intelligence & Interdiction team join Talos Takes to talk about this project. They provide some first-hand insights into what this leaked playbook tells us about the Conti ransomware-as-a-service group. Threat actors — they have feelings just like us!

    ]]>     Jon Munshaw (host), Azim Khodjibaev (speaker), and David Liebenberg (speaker) https://www.talosintelligence.com/podcasts/500 Fri, 12 Aug 2022 12:00:00 -0400 500 Conti, ransomware, APTs full false     Talos Takes Ep. #66: Dude, where's my bandwidth? Talos Takes Ep. #66: Dude, where's my bandwidth? “Proxyware” sounds like a complicated topic that you’re too afraid to ask about. But really, it’s just software that allows users to sell off a portion of their internet bandwidth for a small profit. Problem is, attackers are swooping in on this popular software to spread malware and steal users’ money. Edmund Brumaghin joins the show this week to discuss his recent research into proxyware applications and how malware is hiding in plain sight. Edmund discusses why these types of apps are potentially unwanted applications, and what the threat is for enterprise users with remote workers, as well as personal PC users.

    ]]>     “Proxyware” sounds like a complicated topic that you’re too afraid to ask about. But really, it’s just software that allows users to sell off a portion of their internet bandwidth for a small profit. Problem is, attackers are swooping in on this popular software to spread malware and steal users’ money. Edmund Brumaghin joins the show this week to discuss his recent research into proxyware applications and how malware is hiding in plain sight. Edmund discusses why these types of apps are potentially unwanted applications, and what the threat is for enterprise users with remote workers, as well as personal PC users.

    ]]>     Edmund Brumaghin (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/499 Fri, 12 Aug 2022 12:00:00 -0400 429 proxyware, malware, spam, scams full false     Talos Takes Ep. #65: We're all excited to travel again, but so are attackers Talos Takes Ep. #65: We're all excited to travel again, but so are attackers As more people around the world start to get vaccinated against COVID-19, travel is becoming easier, especially during these summer months. But as much as you may be excited to travel, so are threat actors. Asheer Malhotra was part of a team that looked into a series of campaigns targeting users in Latin America, specifically using social engineering tactics centered around travel. Some of the lure documents, in this case, include fake travel itineraries, coupons for flights and hotel reservation confirmations. Asheer joins the show this week to discuss the throughline between all these attacks and their potential connections to the Aggah crimeware group.

    ]]>     As more people around the world start to get vaccinated against COVID-19, travel is becoming easier, especially during these summer months. But as much as you may be excited to travel, so are threat actors. Asheer Malhotra was part of a team that looked into a series of campaigns targeting users in Latin America, specifically using social engineering tactics centered around travel. Some of the lure documents, in this case, include fake travel itineraries, coupons for flights and hotel reservation confirmations. Asheer joins the show this week to discuss the throughline between all these attacks and their potential connections to the Aggah crimeware group.

    ]]>     Jon Munshaw (host) and Asheer Malhotra (speaker) https://www.talosintelligence.com/podcasts/465 Fri, 12 Aug 2022 12:00:00 -0400 470 Aggah, malspam, social engineering, COVID-19, spam, RATs full false     Talos Takes Ep. #64: We go back to school Talos Takes Ep. #64: We go back to school Students are starting to go back to school across the U.S. There are plenty of things to worry about with the “new normal” while the world still combats COVID-19, and while we can’t help students, teachers and admins with everything, we can at least provide a little security advice. Nick Biasini joins the show once again to discuss the best cybersecurity practices as schools spin back up. What should parents tell their kids about electronic devices they bring home? What will IT admins have learned over the past year and a half plus? And how should we deal with the new norm of hybrid learning?

    ]]>     Students are starting to go back to school across the U.S. There are plenty of things to worry about with the “new normal” while the world still combats COVID-19, and while we can’t help students, teachers and admins with everything, we can at least provide a little security advice. Nick Biasini joins the show once again to discuss the best cybersecurity practices as schools spin back up. What should parents tell their kids about electronic devices they bring home? What will IT admins have learned over the past year and a half plus? And how should we deal with the new norm of hybrid learning?

    ]]>     Nick Biasini (speaker) and Jon Munshaw (host) https://www.talosintelligence.com/podcasts/464 Fri, 12 Aug 2022 12:00:00 -0400 515 school, remote learning, cheating, education, COVID-19, hybrid full false     Talos Takes Ep. #63: Shield your eyes from the Solarmarker Talos Takes Ep. #63: Shield your eyes from the Solarmarker Andrew Windsor from our malware research team joins the show for the first time to talk about Solarmarker. This is a campaign Andrew’s followed for a while that recently added new modules that make it particularly dangerous. The attackers behind Solarmarker could basically use this threat to drop whatever they want. At least for now, they’re sticking to information-stealing. But could it ever get worse than that?

    ]]>     Andrew Windsor from our malware research team joins the show for the first time to talk about Solarmarker. This is a campaign Andrew’s followed for a while that recently added new modules that make it particularly dangerous. The attackers behind Solarmarker could basically use this threat to drop whatever they want. At least for now, they’re sticking to information-stealing. But could it ever get worse than that?

    ]]>     Jon Munshaw (host) and Andrew Windsor (speaker) https://www.talosintelligence.com/podcasts/463 Fri, 12 Aug 2022 12:00:00 -0400 623 malware, Solarmarker, dropper, Uranus, Mars full false