Contacts
Info
DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each...
show more
DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each episode you’ll hear real world insights from our researchers about the latest trends in malware, threat actors, TTPs, and more.
Welcome to DISCARDED
show less
Welcome to DISCARDED
DISCARDED: Tales From the Threat Research Trenches
DISCARDED: Tales From the Threat Research Trenches
The Hunt for Cyber Criminals: A Deep Dive with Wired's Andy Greenberg
24 JUL 2024 · Hello, Cyber Stars! In today's episode of the Discarded Podcast, hosts Selena Larson and Pim Trouerbach are joined by Andy Greenberg, Senior Writer at WIRED. Known for his deep dives into the world of hacking, cybersecurity, and surveillance, Andy shares his journey of uncovering and telling compelling stories about the digital underworld.
The conversation kicks off with Andy detailing his extensive experience in cybersecurity journalism and his knack for long-form storytelling. He shares insights into his acclaimed Wired article on the Mirai botnet hackers and discusses his latest book, Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency.
We also talk about:
- the intricate world of cryptocurrency and its unintended consequence of fueling ransomware attacks
- the rise of pig butchering scams, now dwarfing ransomware in financial impact
- the ethical dilemmas and real-world consequences of cybercrime
Resources mentioned:
https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-Hackers/dp/0385544405 by Andy Greenberg
https://www.amazon.com/Tracers-Dark-Global-Crime-Cryptocurrency/dp/0385548095 by Andy Greenberg
https://www.wired.com/story/mirai-untold-story-three-young-hackers-web-killing-monster/
https://www.wired.com/story/crypto-home-invasion-crime-ring/
https://www.wired.com/story/tigran-gambaryan-us-congress-resolution-hostage-nigeria/
For more information about Proofpoint, https://www.proofpoint.com/us/podcasts.
Subscribe & Follow:
Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.
Have you heard: Only Malware in the Building?
15 JUL 2024 · Check out new episodes of Only Malware in the Building wherever you listen to podcasts:
https://thecyberwire.com/podcasts/only-malware-in-the-building
Malware Evasion Uncovered: The Battle Against Evolving Malware Techniques
9 JUL 2024 · Hello, Cyber Pirates! In today's episode of the Discarded Podcast, hosts Selena Larson and Tim Kromphardt are joined by Kyle Cucci, Staff Threat Researcher at Proofpoint. Dive with us into the world of cyber attacks as Kyle breaks down the intricacies of evasion techniques used by threat actors. From defense evasion to anti-sandboxing and anti-reversing methods, Kyle sheds light on how modern malware ensures its survival. Discover the evolution and increasing sophistication of these techniques, and learn about specific malware families like WikiLoader, Remcos, and the notorious Loki Bot.
We then move into how teams of threat hunters, intelligence analysts, and malware reversers work closely to identify new malware techniques and develop robust defenses within sandbox environments. Kyle shares insights into the constant feedback loop between intelligence and detection teams, highlighting how they stay ahead of evolving threats.
We also talk about:
- evasion strategies, including temperature checks, geofencing, and human detection mechanisms
- the use of publicly available tools by malware authors
- the future of AI and large language models (LLMs) in both aiding and combating cyber threats
Resources mentioned:
- https://nostarch.com/evasive-malware by Kyle Cucci
- SentinelOne Research: https://www.sentinelone.com/blog/blackmamba-chatgpt-polymorphic-malware-a-case-of-scareware-or-a-wake-up-call-for-cyber-security/
For more information about Proofpoint, https://www.proofpoint.com/us/podcasts.
Subscribe & Follow:
Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.
Checkmate: Breaking Down Operation Endgame
25 JUN 2024 · Hello, cyber sleuths! In today's exciting episode of the Discarded Podcast, hosts Selena Larson and Sarah Sabotka are joined by the brilliant Pim Trouerbach, Senior Reverse Engineer at Proofpoint. Pim gives us the lowdown on this massive law enforcement operation targeting multiple high-profile botnets across the globe, called Operation Endgame, and how this coordinated takedown affects the cybercrime landscape and the significance of arresting the individuals behind these operations.
He also breaks down the different malware impacted including SystemBC, IcedID, Pikabot, Bumblebee, and more.
We also talk about:
- the rise and fall of Bumblebee, comparing it to its predecessor, Baza Loader, and contemplating why it didn't quite live up to its anticipated potential despite its advanced features
- the collaborative efforts between law enforcement and private sector partners, emphasizing the effectiveness of these joint operations in curbing cyber threats
- the high-quality, cinematic videos released as part of Operation Endgame
Resources mentioned:
https://www.proofpoint.com/us/blog/threat-insight/major-botnets-disrupted-global-law-enforcement-takedown
https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits
https://operation-endgame.com/
https://www.justice.gov/opa/pr/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operation
https://x.com/Shadowserver/status/1797945864004210843
For more information about Proofpoint, https://www.proofpoint.com/us/podcasts.
Subscribe & Follow:
Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.
Hacking the Human Mind: How Cyber Attackers Exploit Our Brains
11 JUN 2024 · Hello to all our cyber squirrels! Joining our series host, Selena Larson, is our co-host today, Tim Kromphardt. Together they welcome our special guest–Dr. Bob Hausmann, Proofpoint's Manager of Learning Architecture and Assessments and a seasoned psychologist.
Our conversation explores how cyber threat actors exploit the different systems of thought in our brains and how attackers leverage our rapid, emotionally-driven responses (system one thinking) to bypass our more deliberate, rational processes (system two thinking).
Dr. Bob introduces us to the concept of cognitive biases, particularly normalcy bias, and how these mental shortcuts can shape our cyber defense strategies. He explains how organizations often fall into the trap of thinking "it won't happen to us," leading to underinvestment in critical security measures. Drawing parallels to historical events like the sinking of the Titanic and the COVID-19 pandemic, he underscores the importance of overcoming these biases to enhance preparedness.
We also talk about:
- Real-world implications and examples of social engineering attacks.
- The impact of urgency and stress on decision-making in cybersecurity.
- The alarming rise and mechanics of pig butchering scams.
- The role of AI in scams and cybersecurity
- Empathetic approaches to helping scam victims
Resources mentioned:
- Book: https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374533555
- Book: https://www.amazon.com/Art-Deception-Controlling-Element-Security/dp/076454280X
- https://podcasts.apple.com/us/podcast/confidence-confusion-cashout-how-pig-butchering-is/id1612506550?i=1000593529141
- https://haveibeenpwned.com/https://haveibeenpwned.com/
- https://cofense.com/
- https://www.cisa.gov/
- https://www.sans.org/
- https://www.proofpoint.com/us/blog/threat-insight/broken-dreams-and-piggy-banks-pig-butchering-crypto-fraud-growing-online
- https://therecord.media/southeast-asian-scam-syndicates-stealing-billions-annually
- https://www.cfr.org/in-brief/how-myanmar-became-global-center-cyber-scams
- https://www.proofpoint.com/us/blog/threat-insight/dont-answer-russia-aligned-ta499-beleaguers-targets-video-call-requests
For more information about Proofpoint, https://www.proofpoint.com/us/podcasts.
Subscribe & Follow:
Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.
Decrypting Cyber Threats: Tactics, Takedowns, and Resilience
29 MAY 2024 · Hello to all our cyber pals! Joining our series host, Selena Larson, is our co-host today, Tim Kromphardt. Together they welcome our special guest–Daniel Blackford, the Director of Threat Research at Proofpoint. The conversation dives into the intricate world of cyber threats and the impact of law enforcement disruptions on malware, botnets, and ransomware actors.
We'll explore how threat actors react when their preferred infrastructures or ransomware-as-a-service systems get taken down, offering insights into their various responses—from rebuilding and rebranding to the emergence of new power players in the cybercriminal ecosystem.
We also talk about:
- Analysis of the Hive ransomware takedown and the massive Qbot operation, including the technical and human aspects of these disruptions
- How other groups rise to prominence despite disruptions
- Differences between malware disruptions and business email compromise (BEC) or fraud-focused disruptions
- The evolution of threat actor techniques, such as, legitimate remote management tools and living off the land techniques
For more information about Proofpoint, https://www.proofpoint.com/us/podcasts.
Subscribe & Follow:
Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.
It Works on My Machine: Why and How Engineering Skills Matter in Threat Research
8 MAY 2024 · The Discarded Podcast team is gearing up and working hard for a new season! Until then we have a special Re-Run treat--one of our favorite episodes! Enjoy!
Engineering skills can play a massively beneficial role in cyber security, as Pim Trouerbach, a Senior Reverse Engineer at Proofpoint and Jacob Latonis, Senior Threat Research Engineer at Proofpoint, are able to share.
They emphasize the importance of understanding the requirements and context of security researchers to build effective tools. The conversation touches on the potential impact of AI and LLMs (large language models) in threat research. While AI tools can be valuable for entry-level tasks, the context, experience, and expertise of human engineers are essential for handling complex code and understanding threat actors' behaviors.
Join us as we also discuss:
[02:59] The uniqueness of engineering skills in understanding researchers' requirements for data cleaning, tool development, and working in a security environment.
[11:06] How the versioning in malware samples can provide insights into the threat actors' behavior and trajectory.
[13:24] How malware is simply software with malicious intent, and how practices of developers and threat actors can overlap.
[17:10] The tools and techniques used by threat actors, including obfuscation and encryption methods.[21:42] The importance of context and experience in writing tools and understanding researchers' workflows.
For more information, https://www.proofpoint.com/us/podcasts.
Decoding TA4903: Exploring the Dual Objectives of a Unique Cyber Threat Actor
2 APR 2024 · Today’s focus is on the elusive threat actor known as TA4903. But that's not all - we've got a special treat for you as well. Our longtime producer, Mindy, is joining us as a co-host, bringing her expertise and insights to the table, as we turn the mic around and interview, Selena!
We explore recent research conducted by Selena and her team on TA4903’s distinct objectives. Unlike many cybercrime actors, TA4903 demonstrates a unique combination of tactics, targeting both high-volume credential phishing campaigns and lower-volume direct business email compromises.
We also dive into:
- TA4903 spoofs government entities like the Department of Transportation and the Department of Labor to lure victims
- Use of advanced techniques including evil proxy for multi-factor authentication token theft and QR codes for phishing campaigns
- Rising trends in cryptocurrency-related scams and other financial frauds
Resources mentioned:
https://www.proofpoint.com/us/blog/threat-insight/mfa-psa-oh-my (Blog) by Timothy Kromphardt
https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
New TA4903 research: https://www.proofpoint.com/us/blog/threat-insight/ta4903-actor-spoofs-us-government-small-businesses-phishing-bec-bids
For more information, https://www.proofpoint.com/us/podcasts.
A Trip Down Malware Lane: How Today's Hottest Malware Stacks Up Against Predecessors
19 MAR 2024 · It has been a busy first quarter for the Proofpoint Threat Research team! Today we have returning guest, Pim Trouerbach, to share his personal stories about his favorite malware and discuss the current landscape, including insights on Pikabot, Latrodectus, and WikiLoader.
The conversation explores the evolution from old school banking trojans to the current favored payloads from major cybercrime actors, and the changes in malware development through the years. Pim shares the different meticulous analysis and research efforts, and we learn about mechanisms to combat the malware.
We also dive into:
- a valuable lesson about the consequences of malware running rampant in a sandbox environment
- the shifts in attack chains and tactics employed by threat actors
- the need for adaptive detection methods to combat evolving cyber threats
Resources mentioned:
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 by Kim Zetter
Shareable Links:
https://www.proofpoint.com/us/blog/threat-insight/out-sandbox-wikiloader-digs-sophisticated-evasion
https://www.proofpoint.com/us/blog/threat-insight/ta577s-unusual-attack-chain-leads-ntlm-data-theft
https://www.proofpoint.com/us/blog/threat-insight/battleroyal-darkgate-cluster-spreads-email-and-fake-browser-updates
https://www.proofpoint.com/us/blog/threat-insight/bumblebee-buzzes-back-black
https://www.proofpoint.com/us/blog/threat-insight/security-brief-tis-season-tax-hax
Pim’s Favorite Malware:
* Emotet: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a
* IcedID: https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid
* Dridex: https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a
* Hancitor: https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor
* Qbot: https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
* Hikit (APT): https://attack.mitre.org/software/S0009/
* Stuxnet (APT): https://www.penguinrandomhouse.com/books/219931/countdown-to-zero-day-by-kim-zetter/
* Cutwail: https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail
For more information, https://www.proofpoint.com/us/podcasts.
Hiding In Plain Sight: Unique Methods Of C2 From Infostealers
5 MAR 2024 · Network-based detections, such as those developed by threat detection engineers using tools like suricata and snort signatures, play a crucial role in identifying and mitigating cyber threats by scrutinizing and analyzing network traffic for malicious patterns and activities.
Today’s guest is Isaac Shaughnessy, a Threat Detection Engineer at Proofpoint. Isaac shares his insights into the challenges of detecting and mitigating malware, especially those using social platforms for command and control. He emphasizes the team's engagement with the InfoSec community, highlighting the value of platforms like Twitter and Mastodon for sharing and receiving information.
We also dive into:
- the unique challenges of crafting effective signatures
- the specifics of malware, focusing on Vidar stealer and highlighting the dynamic nature of Vidar's command and control infrastructure
- the distribution methods of these malware strains, from email campaigns to unconventional tactics like using video game platforms and social media for luring victims
Resources mentioned:
https://www.youtube.com/watch?v=0mJayM2X6Wo w/ Issac Shaughnessy
Emerging Threats Mastodon: https://infosec.exchange/@emergingthreats
Threat Insight Mastodon: https://infosec.exchange/@threatinsight
https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271
For more information, https://www.proofpoint.com/us/podcasts.
DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each...
show more
DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each episode you’ll hear real world insights from our researchers about the latest trends in malware, threat actors, TTPs, and more.
Welcome to DISCARDED
show less
Welcome to DISCARDED
Information
| Author | Proofpoint |
| Organization | Mindy |
| Categories | Technology |
| Website | www.spreaker.com |
| pfpt-podcasts@proofpoint.com |
Copyright 2024 - Spreaker Inc. an iHeartMedia Company
