The Cybersecurity Defenders Podcast

Proving the value of security operations with Christopher Crowley [344]

LimaCharlie — Thu, 13 Aug 2026 16:52:42 +0000

Today we're speaking with Christopher Crowley, cybersecurity consultant through Montance and Senior Instructor with the SANS Institute, about the value of cybersecurity operations — how to measure it, how to express it to the business, and how AI is changing the work of the SOC.

Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operations centers. He is the author of the annual SANS SOC Survey, a security operations class called SOC-Class, and a new book entitled The Value of Cybersecurity Operations. He is a Senior Instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montance. His background also includes network operations, software development, mobile security assessment, and security policy.

Learn more at https://montance.com and get the book at https://shop.montance.com

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/

Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

Intel Chat: Shai-Hulud is back, model pinning & the token spend problem [343]

LimaCharlie — Sat, 08 Aug 2026 16:52:58 +0000

Intel Chat with Matt Bromiley and Chris Luft — recorded in person at Black Hat USA in Las Vegas, day two.

No prep doc, no script: just what Matt and Chris were actually hearing on the floor.

• Shai-Hulud is back. The self-replicating npm worm returned on August 4, trojanizing the keyv / cacheable family and spreading to 400+ packages within hours. Chris reads through Datadog Security Labs' analysis of the Shai-Hulud 2.0 wave: 796 packages and 1,092 versions, 20M+ weekly downloads, credential harvesting with TruffleHog, GitHub repositories used for both exfiltration and command and control, and a worm that reads its own code to propagate without a C2 server.
• The LLM that downloaded the malicious package by itself. A researcher asked a frontier model about a compromised package, and the model decided the best way to help was to go fetch a copy — tripping the SOC's alert and bypassing the company's centralized package clearing house on the way.
• Non-human identity as the new perimeter. Every agent you introduce is another identity: who created it, what can it reach, how long should it live?
• "Computer says no." Matt's colleague hit a refusal from Opus 5, and the session automatically downgraded to 4.8 and completed the task. Which raises the real question of the episode: do security teams now need model pinning, the way we once needed certificate pinning? And if defenders pin to older models to keep working while adversaries use the newest ones, have we rebuilt the same gap all over again?
• AI governance and change control — which models are approved for which tasks, and what happens when a vendor ships a new version or deprecates an old one.
• Token spend as a CISO budget line item. Enterprises buying tokens at a scale their vendors can't match and pulling those vendors onto their plan, token burn as an insider-threat vector, and why $100,000 of tokens is not $100,000 of productivity.
• Defender takeaways: pin your npm packages, get security off its island and talk to your developers, build approved paths before detections, least privilege and key rotation, and network-gated pushes as a deliberate chokepoint.

Stories covered:
• https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
• https://research.jfrog.com/post/shai-hulud-is-back-august/
• https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
• https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/
• https://unit42.paloaltonetworks.com/npm-supply-chain-attack/

Chapters:
0:00 Live from Black Hat, in person for once
0:48 How Black Hat has changed
4:31 No prep — let's talk about what's actually happening here
4:57 Shai-Hulud is back: supply chain compromise
6:23 The LLM that downloaded the malicious package
7:19 Inside Shai-Hulud 2.0
10:34 When attackers and defenders use the same tools
11:39 Non-human identity is the new perimeter
12:13 Opus 5 said no, so the session downgraded itself
15:23 Do security teams need model pinning?
18:20 Three companies, very nebulous rules
18:35 AI governance: which model for which task
21:19 Token spend hits the security budget
22:58 Is token spend a productivity metric?
25:46 Pin your packages
26:25 Get security off the island
29:17 Least privilege, key rotation, chokepoints
32:55 Why it's called Shai-Hulud
33:25 Wrapping up at Black Hat

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #threatintel #AIsecurity #supplychainsecurity

Intel Chat: Hugging Face AI-agent breach, WP2Shell, Suno & Paidwork leaks, AWS Bahrain strike [342]

LimaCharlie — Thu, 30 Jul 2026 20:34:30 +0000

Intel Chat with Matt Bromiley and Chris Luft.

Matt and Chris break down four stories from the week in threat intel:

• Hugging Face's security incident disclosure: an intrusion conducted end-to-end by an autonomous AI agent system — a malicious dataset exploiting two code-execution paths, thousands of actions across short-lived sandboxes, self-migrating C2 — and why the forensics had to run on the open-weight GLM 5.2 model after hosted frontier models refused to analyze real attack artifacts.

• WP2Shell: attackers chaining CVE-2026-60137 (WordPress Core SQL injection) with CVE-2026-63030 (Batch REST API logic flaw) for unauthenticated remote code execution on default WordPress installs — found by Searchlight Cyber using GPT-5.6 Sol Ultra in about ten hours, with tens of thousands of exploitation attempts following disclosure.

• Data breaches at AI music generator Suno (55.3M unique email addresses, plus partial Stripe payment records) and gig-work platform Paidwork (23.3M addresses, password hashes and banking data), per Have I Been Pwned.

• Iranian state media claims the IRGC destroyed AWS's Bahrain data center (ME-SOUTH-1) with cruise missiles — and what data centers becoming military targets means for cloud resilience.

Plus: Google Threat Intelligence Group retires APT/FIN nomenclature for new threat-actor names, and where to find Chris and Matt at Black Hat.

Stories covered:

• https://huggingface.co/blog/security-incident-july-2026

• https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover

• https://www.securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts/

• https://www.tomshardware.com/tech-industry/data-centers/amazon-data-center-in-bahrain-struck-and-destroyed-by-iranian-cruise-missiles-state-media-claims-attacks-launched-against-aws-site-in-response-to-alleged-us-strikes-on-an-under-construction-nuclear-plant

Chapters:

0:00 Intro & Black Hat plans

2:07 Hugging Face's AI-agent breach disclosure

12:39 WP2Shell: WordPress exploit chain

20:59 Suno & Paidwork data breaches

24:17 IRGC strikes on AWS Bahrain

28:27 Google Threat Intel's new actor names

29:29 Black Hat swag hunt & wrap-up

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:

• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740

• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #threatintel #AIsecurity #databreach

Building trustworthy AI with Rob van der Veer [341]

LimaCharlie — Wed, 29 Jul 2026 15:52:26 +0000

Today we're speaking with Rob van der Veer, Chief AI Officer at Software Improvement Group, about how organizations can build trustworthy AI in an era of rapidly evolving technology and regulation — AI security, threat modeling, international standards, and the new challenges posed by agentic AI.

Rob is a global leader in AI security, software engineering, and international AI standards, with more than 30 years of experience in artificial intelligence. He has played a leading role in developing industry standards and serves as co-editor of the forthcoming European AI security standard supporting the EU AI Act. He is the founder of the OWASP AI Exchange, co-founder of OpenCRE, and has helped bring together standards organizations, industry, and the open-source community to advance practical approaches to secure AI.

Learn more at https://www.softwareimprovementgroup.com and https://owaspai.org

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

AI Chat: The Hugging Face / OpenAI breach — the attacker was the model [340]

LimaCharlie — Thu, 23 Jul 2026 19:01:01 +0000

AI Chat with Maxime Lamothe-Brassard and Chris Luft — a special episode.

One story, pulled apart start to finish. In mid-July 2026, Hugging Face disclosed a breach of its production infrastructure carried out end-to-end by an autonomous AI agent. Five days later, OpenAI revealed the attacker was its own models — GPT-5.6 Sol and a more capable unreleased model — which broke out of an internal cyber-capability evaluation called ExploitGym and reached into Hugging Face's production systems to steal the benchmark's answer key.

In this episode:

• The timeline: Hugging Face's July 16 disclosure, OpenAI's July 21 attribution — and the five days in between when even the victim didn't know an AI did it.

• The attack chain: a malicious dataset abusing two code-execution paths in the dataset-processing pipeline, node-level escalation, credential harvesting and lateral movement — thousands of actions across short-lived sandboxes with self-migrating command-and-control.

• The escape: a zero-day in the eval sandbox's package-registry cache proxy, the single egress control — per OpenAI's own account.

• Motive: the models got "hyperfocused" on winning the benchmark, not stealing data — and whether "no malicious intent" is a fair description or a comforting one.

• What was and wasn't exposed, what to do about your Hugging Face tokens, and why this is not the 2024 Spaces incident or the 2023 OpenAI forum hack.

• Max's hot take: the beginning of the phase where we lock developers out of writing code — and a new fear unlocked: models backdooring other models.

Stories covered:

• https://huggingface.co/blog/security-...

• https://openai.com/index/hugging-face...

Chapters:

0:00 Cold open — the attacker was the model

2:20 The whole story in one breath

6:41 The timeline: two disclosures, five days apart

11:37 Attack chain, part 1: getting in through a malicious dataset

15:53 Attack chain, part 2: escaping the eval sandbox

22:10 Motive, attribution & intent: cheating on the benchmark

25:31 What was (and wasn't) exposed

28:08 The bigger picture: the fire drill started the fire

31:39 Lessons for labs, platforms, and solo developers

33:15 New fear unlocked: models backdooring models

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:

• Spotify: https://open.spotify.com/show/6ep00ze...

• Apple Podcasts: https://podcasts.apple.com/us/podcast...

• YouTube: / @limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #AIsecurity #OpenAI #HuggingFace #infosec

AI Chat: Grok CLI data exfiltration, AI vs. patching, distillation wars & shadow AI [339]

LimaCharlie — Tue, 14 Jul 2026 21:29:33 +0000

AI Chat with Maxime Lamothe-Brassard and Chris Luft.

A new segment on the podcast: AI news in cybersecurity that is less than 24 hours old, discussed while it is still hot. Joining Chris for these conversations is LimaCharlie founder and CEO Maxime Lamothe-Brassard.

In this episode:

• Nipun Gupta (founder of Optimus Labs) reports that xAI's Grok Build CLI packaged and uploaded an entire local Git repository — commit history, branches and .env files with API keys — to a Google Cloud bucket; wire-level analysis via mitmproxy, a quiet server-side fix, and why you should rotate keys if you used the tool.

• Fortinet's take (via Mexico Business News) on AI accelerating vulnerability discovery and exploitation: 24–48 hours from disclosure to active exploitation vs. 16 days to patch — and whether "virtual patching" is a real mitigation or a feat of marketing.

• The AI distillation debate: after years of arguing fair use for scraping the internet, frontier labs now object to competitors training on their model outputs — Business Insider's look at the irony, shared by Pascal Hetzscholdt (Wiley).

• Neon Cyber's survey on shadow AI rising with seniority: 14% of individual contributors use unapproved AI tools vs. 63.7% of managers and 70% of VPs and above — and why enforcement, not awareness, is the real challenge.

Stories covered:

• / guptanipun_my-spare-laptop-ran-completely-...

• https://mexicobusiness.news/cybersecu...

• / pascal-hetzscholdt_quote-heres-some-delici...

• https://neoncyber.com/blog/shadow-ai-...

Chapters:

0:00 Intro — welcome to AI Chat

0:45 Grok Build CLI uploading entire repos (Nipun Gupta / Optimus Labs)

4:57 AI is outpacing patch management — is virtual patching the answer?

12:32 The AI distillation debate: scraping irony at the frontier labs

16:29 Shadow AI use rises with seniority (Neon Cyber)

22:51 Wrap-up

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:

• Spotify: https://open.spotify.com/show/6ep00ze...

• Apple Podcasts: https://podcasts.apple.com/us/podcast...

• YouTube: / @limacharlieio

Intel Chat: Dialogflow Rogue Agent, ghost phishing, CISA KEV deadline & HalluSquatting [338]

LimaCharlie — Thu, 09 Jul 2026 15:44:38 +0000

Intel Chat with Matt Bromiley and Chris Luft.

Matt and Chris break down four stories from the week in threat intel:

• Varonis Threat Labs' "Rogue Agent" — a permission boundary flaw in Google Dialogflow CX's Code Blocks feature that could let an attacker with a single permission (dialogflow.playbooks.update) inject persistent malicious code into a chatbot's execution pipeline and silently exfiltrate conversations; Google has fully patched it, no customer action required.

• The EvilTokens campaign and "ghost phishing" — AES-GCM-encrypted phishing pages that look harmless to URL scanners and only reveal themselves after decrypting in the victim's browser, driving Microsoft device code phishing against Microsoft 365 accounts.

• CISA adds four actively exploited flaws to the KEV catalog with a July 10 patch deadline under BOD 26-04: Adobe ColdFusion (CVE-2026-48282, CVSS 10.0), Langflow (CVE-2026-55255, chained with CVE-2026-33017), and Joomla's SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290) extensions.

• HalluSquatting — Tel Aviv University researchers show attackers can register the repository names AI coding assistants predictably hallucinate, then ride prompt injection to code execution on developer machines — with success rates up to 85% for repos and 100% for skill installs across Cursor, Windsurf, Copilot, Cline, Gemini CLI and more.

Stories covered:

• https://www.darkreading.com/application-security/dialogflow-cx-rogue-agent-flaw-enabled-ai-chatbot-data-theft

• https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html

• https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flaws/

• https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html

Chapters:

0:00 Intro & catching up

4:31 Google Dialogflow CX "Rogue Agent" flaw

11:03 EvilTokens & "ghost phishing"

17:37 CISA KEV: ColdFusion, Langflow & Joomla — patch by July 10

24:56 HalluSquatting: weaponizing AI hallucinations

33:16 Wrap-up

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:

• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740

• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #threatintel #AIsecurity #phishing

Ransomware in the age of agentic AI with Behnaz Karimi [337]

LimaCharlie — Wed, 08 Jul 2026 21:04:45 +0000

Today we're speaking with Behnaz Karimi, an independent researcher specializing in ransomware and agentic AI systems, Senior Cybersecurity Analyst at Accenture, and founder of Tremorina, about how ransomware is evolving to target AI systems, machine learning pipelines, and autonomous agents.

With more than 20 years of experience in cybersecurity, Behnaz is also a leader within the OWASP AI Exchange, where she helps develop AI security frameworks and contributes to international AI security standards. In this conversation we cover the new generation of data-poisoning ransomware, why stolen models and datasets are becoming the ransom, what makes autonomous agents an entirely new attack surface, and how organizations can build resilience into their AI initiatives from day one.

Learn more about the OWASP AI Exchange at https://owaspai.org/

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.

Start today for free at https://limacharlie.io/

Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

Intel Chat: Hijacked AI backends, billboard hacks, Cursor DuneSlide & Claude export controls [336]

LimaCharlie — Fri, 03 Jul 2026 18:07:56 +0000

Intel Chat with Matt Bromiley and Chris Luft.

Matt and Chris break down four stories from the week in threat intel:

• Zenity researchers observed three campaigns where attackers hijacked internet-exposed AI inference endpoints (Ollama, LiteLLM) as free model backends for offensive operations — including the Strix and HexStrike-AI pentesting frameworks and a Codex agent posing as a "security auditor" — enabled by no-auth defaults and placeholder API keys.

https://www.darkreading.com/cloud-security/attackers-hijack-exposed-ai-endpoints-power-offensive-ops

• A CISA advisory on Daktronics controllers behind scoreboards, digital billboards and highway signs: unauthenticated path traversal, arbitrary file upload and default admin credentials chaining to root-level control, found and responsibly disclosed by a Princeton undergrad.

https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/

• Cato's "DuneSlide" (CVE-2026-50548 / CVE-2026-50549) — two critical Cursor flaws where a single prompt injection escapes the terminal sandbox and executes arbitrary commands on a developer's machine; patched in Cursor 3.0.

https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html

• Anthropic restoring worldwide Claude Fable 5 access after the US Commerce Department lifted emergency export controls triggered by a jailbreak — plus what it means for AI governance, open-source model catch-up and the data center debate.

https://thehackernews.com/2026/07/anthropic-restores-claude-fable-5-after.html

Chapters:

0:00 Intro & catching up

1:17 Attackers hijacking exposed AI backends (Ollama & LiteLLM)

9:18 CISA advisory: billboard & highway sign controllers

13:46 Cursor "DuneSlide" prompt-injection sandbox escape

20:34 Claude Fable 5 export controls lifted

28:17 Data centers, nuclear déjà vu & the AI race

33:39 Wrap-up

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #threatintel #AIsecurity #promptinjection

Intel Chat: Cisco CUCM exploited, ransomware profiles, Gamaredon & AI agent phishing [335]

LimaCharlie — Wed, 01 Jul 2026 15:47:48 +0000

Intel Chat with Matt Bromiley and Chris Luft.

Matt and Chris break down four stories from the week in threat intel:

• Cisco CUCM (CVE-2026-20230) — a web-dialer SSRF that chains to root-level RCE, exploited in the wild less than 24 hours after the PoC and full exploit chain were published.

• The latest Ransomware Tool Matrix (RTM) / Ransomware Vulnerability Matrix (RVM) update, profiling three active groups — The Gentlemen, DragonForce and Warlock — and the BYOVD and legit-admin-tool tradecraft they increasingly share.

• Gamaredon's upgraded toolkit against Ukraine (per ESET): new PowerShell downloaders like PteroPaste, Cloudflare tunneling and Workers for C2, and exfiltration to trusted cloud storage such as Amazon S3 and Dropbox.

• Varonis Threat Labs phishing an AI email agent ("Pinchy") — why agents spot technical phishing better than humans yet hand over credentials to a convincing social request, and why you should treat them as privileged junior employees.

Chapters:

0:00 Intro & catching up

2:25 Cisco CUCM exploited within 24h of the PoC

9:57 Ransomware Tool Matrix: The Gentlemen, DragonForce & Warlock

15:44 Gamaredon's upgraded TTPs against Ukraine

22:18 Can AI email agents be phished?

28:08 Wrap-up: Black Hat plans & the LimaCharlie suite

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:

• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740

• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #threatintel #ransomware #DFIR

The evolving fraud landscape in the age of AI with Tamas Kadar [#334]

LimaCharlie — Tue, 30 Jun 2026 17:26:06 +0000

Today we're speaking with Tamas Kadar, CEO / Co-Founder of SEON, about building a safer digital world for businesses. We touch on fraud, how it's evolved in the age of AI, and what we can do to protect ourselves against it.

Tamas' entrepreneurial path began at Corvinus University in Budapest, where the vision for SEON first took shape. Co-founding a cryptocurrency exchange opened his eyes to the scale and complexity of online fraud, sparking the idea for something better. In 2017, that “something better” became SEON. Learn more at https://seon.io/

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Anthropic restriction, ServiceNow incident, Fortinet credential harvesting & Ukraine accesses EU cyber reserve / Intel Chat [#333]

LimaCharlie — Sun, 28 Jun 2026 20:22:43 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Reports state that the US government issued an export control order restricting access to anthropic newly released cloud mythos five and fable five models for foreign nationals.
ServiceNow disclosed a security incident involving an unauthenticated access for an API endpoint that allowed users to query data from customer instances without proper authentication.
A large scale credential harvesting campaign dubbed for to bleed is actively targeting Fortinet firewalls and VPN gateways, and has already compromised more than 30,000 internet facing devices across 194 countries.
Ukraine has been granted access to the European Union's cyber security reserve, giving the country the ability to request assistance from EU approved cyber security experts during major cyber attacks that exceed its own response capabilities.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Last call for Defenders - How we're actually using AI in the SOC with Eric Capuano / Defender Fridays [#332]

LimaCharlie — Sat, 20 Jun 2026 04:51:30 +0000

Join us for the final episode of Defender Fridays as Eric Capuano, creator of Defender Fridays and co-founder of Digital Defense Institute, closes out the series with a candid conversation on how he's actually building and running agentic workflows in the SOC today.

At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

What We'll Discuss

In this episode, Eric Capuano draws on years of SOC operations, detection engineering, and hands-on agentic workflow development to share what's actually working, what isn't, and where the industry needs to be more honest with itself.

Key Topics:

Why agentic workflows are the next evolution of SOAR, and what it takes to build them reliably
How deterministic checkpoints at every stage are essential to making LLM-driven workflows trustworthy
How one team increased their detection engineering output by 900x using agentic workflows running day and night
Why false positive tuning and detection engineering are the right place to start before tackling complex investigative workflows
How to think about model selection in agentic pipelines: cost, task complexity, and stakes
Why organizations with poor data hygiene will struggle to get value from AI regardless of how sophisticated the tooling is
The risks of prompt injection when feeding untrusted inputs into LLMs, and why trusted inputs should always come first
Why the goal is to use LLMs for as little as possible, and push everything else into deterministic steps

About Our Guest

Eric Capuano is the creator of Defender Fridays and co-founder of Digital Defense Institute. He has spent years doing SOC operations, detection engineering, threat hunting, and DFIR, and currently consults on building and deploying agentic SecOps workflows for security teams. He is also the author of the "So You Want to Be a SOC Analyst" training, which has put over 500 students through hands-on SOC workflows using LimaCharlie's free tier.

Watch Us Live

Defender Fridays ran every Friday at 10:30am PT for over 100 sessions. Subscribe to our YouTube channel to catch up on past episodes.

Sponsored by LimaCharlie

This episode is brought to you by LimaCharlie, the Agentic SecOps Workspace (ASW), where AI agents operate security infrastructure using the same controls and authority as human analysts, with every action visible, governed, and auditable.

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Eric Capuano - Co-founder of Digital Defense Institute

FFmpeg's 21 zero-days, Ruby cooldown feature, Microsoft disrupted by Shai-Hulud worm & Meta AI tool compromise / Intel Chat [#331]

LimaCharlie — Mon, 15 Jun 2026 12:45:16 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

DepthFirst reported that it's autonomous security agent discovered 21 previously unknown vulnerabilities in FFmpeg, a widely deployed multimedia framework used across browsers, streaming infrastructure, and other systems that process media.
Bundler, 4.0.13 introduces a new security feature called cooldown, aimed at reducing the impact of software supply chain attacks in the Ruby ecosystem.
A new variant of the Shai-Hulud supply chain worm, known as Miasma, briefly disrupted Microsoft's software development ecosystem after compromising dozens of GitHub repositories.
Meta says approximately 20,000 Instagram accounts may have been compromised through the abuse of an AI powered account recovery support system.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

AI-assisted SOC training with Carlo Anez / Defender Fridays [#330]

LimaCharlie — Fri, 12 Jun 2026 18:56:03 +0000

Join us for this week's Defender Fridays as Carlo Anez, Founder and Lead Instructor at IgniteCyber Academy and DEFCON Training Instructor, breaks down how to build practical blue team skills using open-source labs, MITRE ATTACK, and real-world defender workflows, and where AI fits into the picture without replacing the analyst.

What We'll Discuss

In this episode, Carlo Anez draws on years of SOC operations, detection engineering, and cybersecurity instruction to make the case for hands-on, open-source training as the foundation for developing confident, capable defenders.

Key Topics:

Why cybersecurity training must move beyond passive learning and into real defender workflows
How the OpenSOC initiative uses open-source tools like Wazuh, MISP, The Hive, and TimeSketch to simulate a small-scale fusion center environment
How open-source stacks build transferable skills that translate to enterprise platforms like Splunk and LimaCharlie
Where AI fits in the SOC: summarizing noisy alerts, mapping activity to MITRE ATT&CK, drafting investigation questions, and improving report clarity
Why AI literacy means knowing how to validate AI output against evidence, not just knowing how to write prompts
Why the analyst owns the evidence, the decision, and the communication
How the DEF CON boot camp and online pilot program structure five days of scenario-based training around a final analyst report and CTF capstone

About Our Guest

Carlo Anez is the Founder and Lead Instructor at IgniteCyber Academy and a DEFCON Training Instructor. He spent five years at Rapid7 doing detection engineering, threat hunting, and DFIR workflows, and has supported SOC operations, government contractors, and projects with DARPA, the US Army, and the US Navy. He currently creates SOC-focused content with TCM Security and leads Blue Team Village at DEF CON, where he also presents and trains annually.

Join us every Friday at 10:30am PT for live, interactive discussions with industry experts. Whether you're a seasoned professional or just curious about the field, these sessions offer an engaging dialogue between our guests, hosts, and you, our audience.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Carlo Anez - Founder & Lead Instructor at IgniteCyber Academy

Building practical blue team skills using AI-assisted SOC training with Bobby Ford/ Defender Fridays [#329]

LimaCharlie — Fri, 05 Jun 2026 12:00:24 +0000

Join us for this week's Defender Fridays as Bobby Ford, Chief Strategy and Experience Officer at Doppel, talks about open-source labs, MITRE ATT&CK, and real-world defender workflows.

About Our Guest

Bobby is a globally recognized cybersecurity “geek” with almost three decades of experience, including the last 14 years as a CISO, protecting some of the world’s most complex and operationally intensive enterprises. His career began in the military as a founding member of the Pentagon Computer Incident Response Team. Bobby built and led cybersecurity programs in the Aerospace and Defense industry. He was the first CISO at Exelis Inc. and was the architect of ITT’s global cybersecurity audit function under DOJ oversight.

Transitioning from public to private sector, Bobby served as the first CISO at Abbott Labs, was CISO for Unilever, and most recently was SVP and Chief Security Officer at Hewlett Packard Enterprise (HPE). Known for his collaborative style and empathetic leadership, Bobby fosters an inclusive culture that empowers entire security organizations to excel.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Charles Grandjean - CTO and Co-founder at Hexiagon AI

"Megalodon" Malware in GitHub, Malware-Slop steals from Claude AI, 7-Eleven breach & CISA cPanel vulnerability / Intel Chat [#328]

LimaCharlie — Mon, 01 Jun 2026 15:50:43 +0000

Originally recorded: Friday May 29, 2026

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A large-scale software supply chain attack dubbed “Megalodon” infected thousands of GitHub repositories with credential-stealing malware in a highly automated campaign that unfolded over a six-hour period on May 18, 2026.
Researchers from OX Security have identified a malicious npm package named “mouse5212-super-formatter” that was designed to steal files from Anthropic Claude AI environments by targeting the “/mnt/user-data” directory.
Convenience store giant 7-Eleven disclosed a data breach tied to an attack that occurred on April 8, 2026, involving systems that contained franchise-related documents. SecurityWeek article Matt references.
CISA has issued an urgent warning about a critical vulnerability in the LiteSpeed cPanel Plugin, tracked as CVE-2026-48172, which is already being actively exploited in the wild.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

From PentestGPT to production: The state of AI-assisted offensive security with Charles Grandjean / Defender Fridays [#327]

LimaCharlie — Sat, 30 May 2026 13:00:24 +0000

Join us for this week's Defender Fridays as Charles Grandjean, CTO and Co-founder at Hexiagon AI, breaks down where AI-assisted pen testing actually stands today and what it means for both red teams and defenders.

What We'll Discuss

In this episode, Charles Grandjean draws on his experience building an AI-powered continuous pen testing platform to trace how LLM capabilities have evolved for offensive security, and what the rise of autonomous attack tooling means for defenders.

Key Topics:

How AI pen testing has progressed from unreliable single commands to chaining complex attack sequences
Why the last six months marked a turning point in LLM planning and long-context reasoning
When to use in-context learning and RAG versus fine-tuning, and why most teams should start with the former
Why privacy considerations push serious pen testing operations toward self-hosted models
How the balance between model control and code control has shifted as models have improved
Why unrestricted and fine-tuned open-weights models are lowering the barrier for malicious actors
What automated offense means for defense teams and why the response needs to match the scale of the threat

About Our Guest

Charles Grandjean is the CTO and Co-founder of Hexiagon AI, a company focused on automating penetration testing through AI to enable continuous, around-the-clock security validation. He has been building and iterating on AI-assisted offensive tooling for the past two years, tracking the evolution of LLM capabilities firsthand from early prototype to production system.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Charles Grandjean - CTO and Co-founder at Hexiagon AI

GitHub repositories compromised, Webworm targets Europe, fake Outlook & cybercriminal VPN / Intel Chat [#326]

LimaCharlie — Fri, 29 May 2026 14:25:16 +0000

Originally recorded: Friday May 22, 2026

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

GitHub has confirmed that roughly 3,800 internal repositories were accessed in a supply chain compromise tied to the hacking group TeamPCP.
China-aligned threat actor Webworm has shifted its targeting focus from Asia to Europe, according to new research published by ESET.
Researchers uncovered a previously undocumented Microsoft 365 account takeover panel that integrates directly with Evilginx Pro infrastructure to streamline token theft and post-compromise operations.
European and North American law enforcement agencies announced the dismantling of “First VPN,” a VPN service allegedly built to support cybercriminal activity including ransomware operations, data theft, scanning, and denial-of-service attacks.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How analysts use cognitive reasoning in investigations with Chris Sanders / Defender Fridays [#325]

LimaCharlie — Fri, 22 May 2026 16:20:25 +0000

Join us for this week's Defender Fridays as Chris Sanders, Founder at Applied Network Defense and the Rural Technology Fund, breaks down how analysts actually think through investigations and what separates high performers from the rest.

What We'll Discuss

In this episode, Chris Sanders draws on his background in security operations and cognitive psychology to explore how metacognition shapes investigative performance, and why understanding how you think is one of the most underleveraged skills in the SOC.

Key Topics:

Why high-performing analysts ask better questions instead of starting with large chunks of data
How diagnostic inquiry (DINQ) was developed by studying senior analysts in action
What separates one year of experience repeated twenty times from genuinely diverse experience
Why tacit knowledge makes it hard to train new analysts and what to do about it
How AI fits into the investigative process and where humans still need to be in the loop
Why cybersecurity education has a transfer problem and what other fields like medicine get right
What good SOCs have in common and why it comes down to metacognitive awareness

About Our Guest

Chris Sanders is the Founder of Applied Network Defense, a training company focused on analyst and investigative roles, and the Rural Technology Fund, an organization that supports technology education in rural and underserved communities. He holds a doctorate in education and has spent his career at the intersection of cybersecurity and cognitive psychology, including time at school districts, the federal government, and Mandiant.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Chris Sanders - Founder at Applied Network Defense & Rural Technology Fund

"Dirty Frag", Canvas ransomware attack, “Mini Shai-Hulud” malware campaign & AI-developed zero-day exploit / Intel Chat [#324]

LimaCharlie — Mon, 18 May 2026 10:00:19 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Researchers have disclosed a new Linux local privilege escalation technique called “Dirty Frag,” which chains together two kernel vulnerabilities: CVE-2026-43284 in xfrm-ESP handling and CVE-2026-43500 in RxRPC.
The breach affecting educational technology provider Instructure has raised broader concerns about the security dependencies schools have on third-party cloud platforms.
Security researchers at Aikido are tracking a major expansion of the “Mini Shai-Hulud” malware campaign targeting the npm ecosystem.
Google Threat Intelligence Group says threat actors are moving from experimental AI usage toward large-scale operational integration of generative models across the cyberattack lifecycle.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How to handle increasing vulnerabilities with AI-assistants? With Shane Warden from ActiveState / Defender Fridays [#323]]

LimaCharlie — Fri, 15 May 2026 18:17:13 +0000

Join us for this week's Defender Fridays as Shane Warden, Principal Architect at ActiveState, shares what it's actually like to be on the receiving end of AI-assisted vulnerability reporting and what open source maintainers are already dealing with that the rest of the industry will face soon.

What We'll Discuss

In this episode, Shane Warden draws on his experience supporting security for well-known open source projects to explore how AI-assisted vulnerability reporting is changing the threat landscape, and why what's happening in open source today is a preview of what every organization will face.

Key Topics:

Why open source projects are the early warning system for what's coming to enterprise security
How a flood of 95 AI-generated vulnerability reports turned into a six-figure extortion attempt
Why even a three percent legitimate hit rate still creates a real and unignorable workload for maintainers
How teams are using AI to respond to AI-generated reports, and where humans still need to be in the loop

What projects like curl, the Linux kernel, and Zig are doing differently in response to AI contributions
Why understanding your open source dependencies and their versions is more urgent than ever
The reputational risk of AI-generated vulnerability claims, even when those claims are false

About Our Guest

Shane Warden is Principal Architect at ActiveState and has been involved in open source since the late 1990s. Behind the scenes, he supports security for several well-known free software projects and has been navigating the growing wave of AI-assisted vulnerability submissions firsthand.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand

Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Shane Warden - Principal Architect at ActiveState

Does the rise of AI mean human-led SOCs are obsolete? With Dr. Adeel Shaikh Muhammad [#322]

LimaCharlie — Wed, 13 May 2026 13:00:22 +0000

Dr. Adeel Shaikh Muhammad, a cybersecurity strategist and global speaker with over 16 years of experience across information security, networks, and systems. Adeel brings a practical perspective on how organizations can adapt to evolving cyber threats and the growing role of AI in cybersecurity.

Adeel, with an extraordinary portfolio of 40+ industry certifications, including CISSP, CISM, CISA, CCISO, PMP, CEH, ISO 27001 Lead Implementer & Auditor, and a robust suite of advanced Cisco, Microsoft, Fortinet, Barracuda, ITIL, PRINCE2, and AI-related credentials, he is a benchmark of technical mastery and visionary execution. His academic excellence includes a Master’s in Cybersecurity and a current Doctorate in Business Administration (DBA) focused on the impact of AI in Security Operations Centers (SOCs) in the Gulf region.

Adeel is the author of two acclaimed books—“AI-Driven Transformation of Security Operations Center (SOC)” and “AI and Us: The Ethical Choices”—bridging the critical intersection of AI innovation and ethical leadership.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Daily breach attempts target UAE, fake ransomware attack, PAN-OS vulnerability & Microsoft’s Phone Link attack / Intel Chat [#321]

LimaCharlie — Tue, 12 May 2026 17:35:43 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

The cyber threat environment in the Middle East has intensified sharply following military operations involving Israel, the United States, and Iran.
An intrusion campaign attributed with moderate confidence to the Iranian state-linked group MuddyWater was disguised as a Chaos ransomware attack, according to research from Rapid7.
Palo Alto Networks has warned customers that a critical remote code execution vulnerability in PAN-OS is being actively exploited in the wild.
Attackers are abusing Microsoft’s Phone Link application in a campaign that Cisco Talos says has been active since January. Report here.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

AI: The Hero's Journey with Ken Westin from LimaCharlie / Defender Fridays [#320]

LimaCharlie — Fri, 08 May 2026 07:51:15 +0000

In this episode, Ken Westin maps AI adoption onto the hero's journey framework, drawing on two decades of security experience to explore how practitioners can move past early resistance, build real fluency with AI tools, and find a working model where humans and AI operate together.

Key Topics:

Why early AI tools left security teams skeptical and what has genuinely changed since then
How Ken used AI to accelerate detection engineering without sacrificing analyst oversight
Why AI is best understood as an eager, overconfident intern that still needs supervision
The importance of hands-on experimentation over passive observation when learning AI
How collaboration and shared prompting practices are shaping how practitioners learn
Why security analysts who engage with AI now will not be left behind as the field evolves
The case for AI as a tool of empowerment, not replacement

About Our Guest

Ken Westin is a Senior Solutions Engineer at LimaCharlie with nearly two decades in the cybersecurity industry. A former startup founder who built tools to track criminal activity, Ken has worked across SIEM, EDR, and detection engineering throughout his career. He also teaches at the college level, where AI and cybersecurity are increasingly intertwined disciplines.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

Sponsored by LimaCharlie

Why LimaCharlie?

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Accelerate response with agentic AI that acts directly within predefined workflows

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Guest: Ken Westin - Senior Solutions Engineer at LimaCharlie

Power systems under threat, Claude Mythos, suspicious KICS activity & JFrog / Intel Chat [#319]

LimaCharlie — Wed, 06 May 2026 21:22:25 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Researchers are raising concerns about a new cybersecurity risk emerging from the systems that regulate electrical power inside modern electronics and infrastructure.
Japan’s financial sector is responding to concerns around Anthropic’s new AI model, Claude Mythos, which some officials believe could significantly impact cybersecurity.
Docker and Socket researchers discovered that malicious images were pushed to the official checkmarx/kics Docker Hub repository, indicating a supply chain compromise affecting the KICS infrastructure-as-code scanning tool.
JFrog security researchers identified a malicious npm package published as @bitwarden/cli version 2026.4.0 that impersonates the legitimate Bitwarden command-line client.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How AI adoption in enterprise infrastructure has expanded the attack surface with Katherine McNamara from Cisco / Defender Fridays [#318]

LimaCharlie — Mon, 04 May 2026 10:00:19 +0000

Today on Defender Fridays, Katherine McNamara, Cybersecurity Technical Solutions Architect at Cisco, joins us to discuss how AI and ML adoption in enterprise infrastructure has expanded the attack surface for AI-driven systems.

She'll walk through the security challenges unique to generative AI and ML-based architectures, and cover the four critical components: Model, Data, Application, and System, that organizations need to secure to maintain integrity.

Katherine works for Cisco as a Cybersecurity Systems Engineer by day and by night, she's labbing and trying new things with the resources she has available. Katherine loves technology and getting her hands into the CLI or trying something new. She holds a Bachelors of Science and Masters of Information Security and Assurance from Western Governors University as well as several industry certifications.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

This episode is brought to you by LimaCharlie, a cloud-native SecOps platform where AI agents operate security infrastructure directly. Founded in 2018, LimaCharlie provides complete API coverage across detection, response, automation, and telemetry, with multi-tenant architecture designed for MSSPs and MDR providers managing thousands of unique client environments.

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

Cybersecurity is a core leadership issue & opportunity with David Chernitzky from Armour Cybersecurity [#317]

LimaCharlie — Wed, 29 Apr 2026 13:56:15 +0000

Today David Chernitzky, Co-Founder and CEO of Armour Cybersecurity, breaks down the challenges small and mid-sized businesses face in the new blink-and-you-miss-it cybersecurity landscape. Don't be left behind and open yourself to AI-driven attacks from threat actors.

David Chernitzky brings over 25 years of deep cybersecurity and military cyber intelligence experience, with a career rooted in strategic risk management and protecting critical systems against advanced threats. As the driving force behind Armour Cybersecurity, he has guided the company’s growth into a trusted global security partner for enterprises and small-to-midsized organizations. David combines strategic vision with hands-on expertise to deliver practical, high-impact cyber defence solutions. Learn more here: https://armourcyber.io/

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Millions in crypto stolen, Vercel breach, Mastodon DDoS attack, North Korean IT workers at 100s of U.S. companies & ransomware negotiator pleads guilty / Intel Chat [#316]

LimaCharlie — Mon, 27 Apr 2026 12:45:13 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

North Korea-linked hackers are believed to be responsible for a $290 million cryptocurrency theft targeting the Kelp DAO decentralized finance protocol.
Vercel, the company behind the popular Next.js web framework and a frontend cloud platform for deploying and hosting web applications, has confirmed that it suffered a security breach involving unauthorized access to internal systems.
The decentralized social media platform Mastodon experienced a major distributed denial-of-service attack that caused a significant outage on its flagship server, Mastodon.social.
Two U.S. nationals have been sentenced for helping North Korean remote IT workers fraudulently obtain jobs at more than 100 U.S. companies using stolen American identities.
A former ransomware negotiator has pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to conduct attacks against U.S. organizations in 2023.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Real examples of AI-powered code scanning with Jeff McJunkin from Rogue Valley Information Security / Defender Fridays [#315]

LimaCharlie — Mon, 27 Apr 2026 04:56:19 +0000

Jeff McJunkin, Founder of Rogue Valley Information Security, joins Defender Fridays to talk AI-powered code scanning for vulnerabilities. Jeff walks through real examples including using AI to find privilege escalation bugs in the Linux kernel.

Jeff McJunkin is the founder of Rogue Valley Information Security, a consulting firm specializing in penetration testing and red team engagements. Jeff found the offensive side of cyber security very alluring during one the first penetration tests of his career. Feeling the challenge of host defenses like AV and centralized logging, and, at the time, knowing nothing about AV evasion or avoiding events that are likely to cause alerts, it was all very exciting. The challenge of successfully accomplishing the goal of that pen test, using essentially only native tools, was addictive for Jeff. He was hooked. Since those first penetration tests, Jeff has gone on to become an expert in the field, doing assessments for Fortune 100 companies, architecting two major versions of Core NetWars Experience, and contributing a vast amount of material to SANS Penetration Testing.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

How can we improve global security? With J. Michael Daniel from Cyber Threat Alliance [#314]

LimaCharlie — Wed, 22 Apr 2026 13:35:20 +0000

J. Michael Daniel, President and CEO of Cyber Threat Alliance (CTA), gives us a peek behind the U.S. Government cybersecurity curtain and how he has helped improve the nation's security through the CTA.

Michael leads the CTA team and oversees the organization's operations. Prior to joining the CTA in February 2017, Michael served from June 2012 to January 2017 as Special Assistant to President Obama and Cybersecurity Coordinator on the National Security Council Staff. In this role, Michael led the development of national cybersecurity strategy and policy, and ensured that the US government effectively partnered with the private sector, non-governmental organizations, and other nations. Learn more at: https://www.cyberthreatalliance.org/

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

China-linked group targets cloud workflows, Russian cyber espionage, agentic AI systems flaw & Nginx vulnerability / Intel Chat [#313]

LimaCharlie — Mon, 20 Apr 2026 13:00:20 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Intercept and control AI agent activity with Viberails by LimaCharlie: viberails.io

APT41, a China-linked threat group is deploying a previously undetected backdoor targeting Linux based cloud workflows.
Fancy bear, also known as APT28 or Forest Blizzard, is a Russian cyber espionage group believed to operate on behalf of the country's military intelligence services, the GRU. Trend Micro research here.
Anthropic’s Model Control Protocol widely used in agentic AI systems to connect AI agents with data sources, contains a design flaw that would enable large-scale supply chain attacks. Report here.
There's a critical vulnerability in nginx-UI, a web-based management interface for Nginx servers, which is being actively exploited and could allow attackers to take full control affected systems.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How do you know your AI agents are actually correct? With Dylan Williams from Spectrum Security / Defender Fridays [#312]

LimaCharlie — Fri, 17 Apr 2026 13:16:04 +0000

Today, Dylan Williams, Co-Founder and Chief Research Officer at Spectrum Security, joins Defender Fridays to dig into that exact problem: self-evaluating agents, trajectory analysis, and what improvement looks like in production.

Learn more at https://www.spectrum.security/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

Understanding how attackers think & helping you avoid threats with Terry Bradley from Mile High Cyber [#311]

LimaCharlie — Wed, 15 Apr 2026 13:00:21 +0000

Terry Bradley, Founder and President of Mile High Cyber, shares how you can uncover vulnerabilities and strengthen your organization's defenses with expert penetration testing and security assessments.

Terry is a former hacker for the NSA and uses those same skills at Mile High Club, the firm he founded, to help businesses stay one step ahead of cybercriminals. After a lifelong passion for security, starting with his time as a 1990 graduate of the U.S. Air Force Academy, Terry has spent his career understanding how attackers exploit weaknesses and helping businesses stay ahead of threats. From penetration testing to enterprise risk management, he's worked with organizations of all sizes to uncover vulnerabilities, enhance security resilience, and protect what matters most. Learn more at https://www.milehighcyber.com/

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Iran-linked cyber attacks U.S. critical infrastructure, FlamingChina, Node.js targeted & Storm-1175 / Intel Chat [#310]

LimaCharlie — Mon, 13 Apr 2026 13:00:21 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Federal cybersecurity agencies have issued an urgent warning about Iran-linked cyberattacks targeting operational technology (OT) systems across U.S. critical infrastructure.
A hacker operating under the alias “FlamingChina” claims to have breached a Chinese state-run supercomputing facility and stolen a large dataset that may exceed 10 petabytes of information.
Multiple high-profile maintainers in the Node.js ecosystem report being targeted in a coordinated social-engineering campaign aimed at compromising widely used open-source packages.
Microsoft Threat Intelligence reports that the cybercrime group Storm-1175 is conducting rapid ransomware campaigns deploying the Medusa ransomware family.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Levelling up your AI SOC with Joshua Neil from Alpha Level / Defender Fridays [#309]

LimaCharlie — Fri, 10 Apr 2026 13:36:59 +0000

Joshua Neil, Co-Founder of Alpha Level, dives into a more sophisticated understanding of AI SOCs. Join the conversation about this industry change on Defender Fridays.

Dr. Joshua Neil, has been a pioneer in applying machine learning to cybersecurity since 2000, starting his journey at Los Alamos National Laboratory. There, he co-developed Pathscan, a network anomaly detection system capable of spotting attacks that slip past traditional defenses. In 2014, he and CEO Mike Pozmantier took that innovation to market by licensing Pathscan to Ernst & Young (EY), turning deep research into enterprise impact.

That experience exposed a hard truth: anomaly detection is powerful at catching unknown threats - but on its own, it creates too much noise. Josh went on to tackle the other half of the problem, alert overload, through leadership roles at Microsoft and Securonix, gaining firsthand insight into the real-world struggles of security teams.

In 2023, Josh and Mike launched Alpha Level to bring both worlds together: pairing the depth of anomaly detection with the precision of behavioral threat signals. The result? A platform that reduces false positives, adapts to your environment, and lets teams focus on real threats—before they become breaches. Learn more here: https://alphalevel.ai/

Learn more at reconinfosec.com

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

Why cyber analysts are crucial in protecting public infrastructure with Michael Hamilton from PISCES International [#308]

LimaCharlie — Wed, 08 Apr 2026 13:00:20 +0000

Michael Hamilton, Chief Technology Officer at PISCES International, joins us to discuss the benefits of providing real world experience to students while they protect existing public infrastructure. The resilient future of local government security rests in our ability to adapt to changing threats and adopt new technologies, including AI.

Learn more at https://pisces-intl.org/

30 years in Information Security as a practitioner, entrepreneur, consultant, and in executive management. Direct experience in retail, manufacturing, government, defense, academic, semiconductor, energy, law enforcement, transportation, publishing and financial sectors - from Fortune 1 to small nonprofits.

Formerly: Policy Advisor to Washington State, Chief Information Security Officer for the City of Seattle, and Managing Consultant for VeriSign Global Security Consulting. Former Vice-Chair of the DHS State, Local, Tribal and Territorial Government Coordinating Council.

Currently: Field CISO, Lumifi Cyber

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Iran’s IRGC threatens U.S. tech companies, FBI Director hacked, Venom Stealer & Hasbro cyber attack / Intel Chat [#307]

LimaCharlie — Mon, 06 Apr 2026 13:00:28 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Iran’s Islamic Revolutionary Guard Core, or the IRGC, announced that it plans to begin attacks on more than a dozen American technology companies operating across the middle east, starting after 8pm Tiran time on April 1st.
A pro-Iranian hacking group, known as Hendala, has claimed responsibility for breaching a personal account belonging to FBI Director, Kash Patel.
A newly discovered malware-as-a-service platform called Venom Stealer is automating the creation and deployment of quick-fix social engineering attacks, significantly lowering the barrier for cyber criminals.
Toy and entertainment company, Hasbro, disclosed that it experienced a cyber attack that disrupted some of its internal operations, in a filing with the U.S. Securities and Exchange Commission.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Malicious geopolitical cyber activity, cyberattacks tied to conflict in Iran, open source supply chain attack & AI autonomous espionage / Intel Chat [#306]

LimaCharlie — Mon, 30 Mar 2026 13:00:13 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Since the onset of the conflict in the Gulf region, cybersecurity researchers have observed a noticeable rise in malicious cyber activity tied to geopolitical events.
Unit 42 researchers are warning about an increased risk of destructive cyberattacks tied to the conflict involving Iran.
The hacking group known as TeamPCP has expanded a large-scale supply chain campaign targeting widely used open source software ecosystems.
In September 2025, Anthropic disclosed an incident in which a state-sponsored threat actor used an AI coding agent to conduct an autonomous cyber espionage campaign targeting 30 organizations worldwide.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

What makes a strong security team? With Andrew Cook from Recon InfoSec / Defender Fridays [#305]

LimaCharlie — Fri, 27 Mar 2026 12:02:56 -0100

This week on Defender Friday we are joined by Andrew Cook, CTO of Recon InfoSec, to talk about what it means to build a strong security team and why hiring builders is always a good bet.

As the CTO of Recon InfoSec, a leading provider of managed security operations, Andrew oversees the technical vision, strategy, and execution of their services and solutions. He has more than a decade of experience in threat hunting, digital forensics, network defense, and capability development.

Andrew's mission is to provide customers with the expertise they need to confidently and effectively respond to incidents, protect their organizations, and enhance their resilience. He has a proven track record of delivering high-quality results, leading and mentoring teams, and collaborating with partners across the industry and the government. Andrew is also a former Air Force officer, with national-level contributions and a passion for technical leadership.

Learn more at reconinfosec.com

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

Bringing 40+ year old industrial security systems into the 21st century with Justin Searle from InGuardians [#304]

LimaCharlie — Wed, 25 Mar 2026 15:03:27 -0100

Justin Searle, Director of ICS Security at InGuardians, joins us today to talk about the challenges facing industrial control system security. With increased attack surface areas and maintaining and updating decades-old systems, Justin's dedication to informing and educating newcomers and experts alike is more important now than ever before.

As the Director of ICS Security at InGuardians, Justin specializes in ICS security architecture design and penetration testing. He led the Smart Grid Security Architecture group in creating the NIST Interagency Report 7628 and has played key roles in the Advanced Security Acceleration Project for the Smart Grid (ASAP-SG), National Electric Sector Cybersecurity Organization Resources (NESCOR), and Smart Grid Interoperability Panel (SGIP).

Justin is the owner of ControlThings LLC, a member of the SANS faculty, and an instructor at BlackHat. He has authored and taught numerous courses such as ICS410: ICS/SCADA Security Essentials, Assessing and Exploiting Control Systems and IIoT, Assessing and Exploiting Web Applications with SamuraiWTF, and SEC542: Web App Penetration Testing and Ethical Hacking. Justin also presents on a range of cybersecurity topics at leading security conferences across the globe.

Learn more at: controlthings.io

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Is it smart to have AI agents act as employees? With David Burkett from Corelight / Defender Fridays [#303]

LimaCharlie — Fri, 20 Mar 2026 13:56:44 -0100

David Burkett, Cloud Security Researcher at Corelight, is back on Defender Fridays this week to discuss thinking in pipelines for AI agents.

As a dedicated and highly experienced Cloud Detection Engineer and Security Architect, David has the privilege of working at a Fortune 50 Company where he leverages his extensive background in cybersecurity to protect digital assets. With a proven track record of building three different Cyber Security Operations Centers for multiple MSSP/MDR providers.

David's expertise is backed by a strong set of GIAC certifications, including GCTI, GCIA, GPYC, and GCED... among others. He's proud to have been part of a large overall security team that won the prestigious James S. Cogswell Outstanding Industrial Security Achievement Award from the Defense Counterintelligence and Security Agency. Our security operations center was recognized as being among the top 1% of cybersecurity programs for all cleared facilities.

In addition to his hands-on experience, David has consulted for over 40 Fortune 500 Companies and Large Federal Organizations, helping them manage their SOAR platforms and playbooks. As a strong believer in knowledge sharing and collaboration, he's also an active contributor to the open-source detection security project known as Sigma. Learn more at https://corelight.com/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

How to think long-term growth in an AI-dominated industry with Stel Valavanis from onShore Networks [#302]

LimaCharlie — Thu, 19 Mar 2026 12:00:29 -0100

Today we're speaking with Stel Valavanis, Founder and Chairman at onShore Networks and Co-Founder at The Gallery Building, about sustaining a security company over three decades of industry changes. We also dive into investing in start ups and how founders can think long term about governance and growth.

Stel has over 40 years of experience ranging from software development to network design and cybersecurity. He's founded 8 companies, invested in 10 more, and sit on various boards. His goal is to build the best tech stack for his customers but also wants to pay forward and make investments in startups, leveraging his knowledge and resources. Stel is always open to board positions and speaking engagements on cybersecurity, media technology, startup investing, and entrepreneurship.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Cyber Strategy for America, new targets in war in Iran, Camaro Dragon & medical manufacturer Stryker attacked / Intel Chat [#301]

LimaCharlie — Tue, 17 Mar 2026 12:41:06 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

The White House released President Trump’s Cyber Strategy for America, outlining a national framework to strengthen both defensive and offensive cybersecurity capabilities.
Iran has expanded the scope of potential targets in the ongoing conflict with Israel and the United States by identifying infrastructure tied to major American technology companies in the Middle East as “legitimate targets.”
Chinese-linked threat actors have launched cyberattacks against organizations in Qatar shortly after the initial US-Israel strikes on Iran, indicating a shift in regional targeting strategy.
An Iranian-linked hacking group has claimed responsibility for a cyberattack on U.S.-based medical equipment manufacturer Stryker, which disrupted the company’s technology operations across its global offices.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Drones damage data centers, Iranian cyber retaliation, Sloppy Lemming & Honeywell vulnerability / Intel Chat [#300]

LimaCharlie — Mon, 09 Mar 2026 11:56:06 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Iranian drone strikes damaged three Amazon Web Services data center facilities in the Middle East, highlighting the physical risks associated with large-scale cloud infrastructure.
Cyber activity linked to Iran and pro-Iranian actors has intensified following a joint US–Israeli military strike on Iran that killed Supreme Leader Ayatollah Ali Khamenei and several other government officials.
The India-linked advanced persistent threat group known as “Sloppy Lemming” has significantly increased its cyber operations over the past year, targeting organizations in Pakistan, Bangladesh, and other parts of South and Southeast Asia.
A cybersecurity researcher has reported a potentially serious vulnerability in Honeywell’s IQ4 building management controller, though the vendor disputes both the severity and practical impact of the issue.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Learning how to trust that AI is secure with Saurabh Shintre from Realm Labs / Defender Fridays [#299]

LimaCharlie — Mon, 09 Mar 2026 10:02:48 -0100

Saurabh Shintre, Founder and CEO of Realm Labs, is on Defender Fridays today to discuss securing AI from within.

Saurabh previously led the AI security research at Splunk and Symantec. He has been at the forefront of AI security research for nearly a decade with multiple publications and patents and regularly features on public forums on issues regarding security and AI. Saurabh holds a PhD from Carnegie Mellon. Learn more at https://www.realmlabs.ai/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io/

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

North Korean malware interviews, FortiGate firewall compromised, Cisco zero-day & Citrini Research AI future / Intel Chat [#298]

LimaCharlie — Tue, 03 Mar 2026 13:57:35 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

GitLab’s Threat Intelligence Team published detailed findings on North Korean activity associated with the Contagious Interview campaign and broader IT worker operations.
A financially motivated, Russian-speaking threat actor used generative AI tools to compromise more than 600 Fortinet FortiGate firewall instances between January and February, according to Amazon Web Services.
Cisco has released emergency patches for a critical zero-day vulnerability in its Catalyst SD-WAN products that has been actively exploited in the wild.
Citrini Research presents a forward-looking scenario framed as a June 2028 macro memo describing a “Global Intelligence Crisis” triggered by abundant AI-driven intelligence.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

AI Red Teaming with John V from the Institute for Security and Technology / Defender Fridays [#297]

LimaCharlie — Fri, 27 Feb 2026 15:23:16 -0100

John V, AI risk, safety, and security at the Institute for Security and Technology (IST), joins Defender Fridays today.

John's work spans AI red teaming, adversarial machine learning, AI evals and validation, and AI risk assessment, including policy work at the intersection of AGI and nuclear strategic stability. Learn more at https://securityandtechnology.org/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

How to Strengthen Cyber Resilience in an AI Era with Chris Cochran from SANS Institute [#296]

LimaCharlie — Wed, 25 Feb 2026 13:00:36 -0100

On this episode of The Cybersecurity Defenders Podcast, we speak with Chris Cochran, Field CISO & Vice President of AI Security at SANS Institute, about how to navigate the future of AI risk and security strategy

Chris works at the intersection of cyber defense, AI safety, and emerging risk, where the threats are converging and the playbooks are still being written. His career has taken him from the Marine Corps to NSA, U.S. Cyber Command, the U.S. House of Representatives, Mandiant, and Netflix. Across every role, one throughline: understanding adversaries, building high-trust teams, and translating complex problems into strategies leaders can act on.

Today, Chris advises organizations, governments, and research institutions on AI governance, agentic threat preparedness, and unifying safety and security into a single discipline. He contributes to global standards efforts including the EU AI Act (via OWASP AI) and leads executive education on cybersecurity and AI strategy at SANS.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

DoppelBrand targets fortune 500s, Android malware Keenadu, attackers expand AI adoption & endless AI-driven threats / Intel Chat [#295]

LimaCharlie — Mon, 23 Feb 2026 13:00:35 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A financially motivated threat actor known as GS7 is conducting a large-scale phishing campaign called Operation DoppelBrand, targeting Fortune 500 companies by impersonating their corporate login portals.
Kaspersky researchers have analyzed a newly identified Android malware strain named Keenadu that provides attackers with remote control over infected devices.
Application Programming Interfaces continue to be a primary attack surface, and new research from Wallarm shows the problem is accelerating as AI adoption expands.
Hacker News outlines cybersecurity technology priorities for 2026, framing the environment as one of continuous instability rather than periodic disruption.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How is AI reshaping app security? With Farshad Abasi from Eureka DevSecOps / Defender Fridays [#294]

LimaCharlie — Fri, 20 Feb 2026 14:30:09 -0100

This week on Defender Fridays, Farshad Abasi, Founder and CEO of Forward Security and Eureka DevSecOps, discusses how AI can help us set a new standard in app and cloud security.

Farshad brings over 27 years of industry experience to the forefront of cybersecurity innovation. His professional journey includes key technical roles at Intel and Motorola, evolving into senior security positions as the Principal Security Architect for HSBC Global, and Head of IT Security for the Canadian division.

Farshad's commitment to the field extends to his role as an instructor at BCIT, where he imparts his wealth of knowledge to the next generation of cybersecurity experts. His diverse experience, which spans startups to large enterprises, informs his approach to delivering adaptive and reliable solutions.

Engaged actively in the cybersecurity community through roles in BSides Vancouver/MARS, OWASP Vancouver/AppSec PNW, and as a CISSP designate, Farshad's vision and leadership continue to drive the industry forward. Under his guidance, Forward Security is setting new standards in application and cloud security. Learn more at https://www.eurekadevsecops.com/ and https://forwardsecurity.com/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

Russian cyber ops, Sygnia, Ollama & TeamPCP / Intel Chat [#293]

LimaCharlie — Mon, 16 Feb 2026 13:00:36 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Russian cyber operations have maintained a consistent focus on exploiting both tactical and strategic targets within the defense industrial base, particularly in the context of the war in Ukraine.
Sygnia has disclosed a large-scale, AI-driven scam operation involving over 150 cloned websites impersonating law firms.
A joint investigation by SentinelLabs and Censys has revealed a growing ecosystem of publicly exposed AI compute infrastructure, driven largely by deployments of Ollama - an open-source framework for running large language models locally.
Flare has identified a widespread, ongoing campaign attributed to a threat actor group known as TeamPCP -also operating under aliases such as PCPcat and ShellForce - which has compromised over 60,000 servers worldwide since late December.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Are we overlooking our most precious resource - ourselves? With Brandon Min from Herd Security / Defender Fridays [#292]

LimaCharlie — Fri, 13 Feb 2026 13:00:32 -0100

This week Brandon Min, Founder and CEO of Herd Security, joins Defender Fridays to discuss how human risk management needs to rebrand with empathy.

Brandon is the co-founder and CEO of Herd Security, where they help security teams drive employee engagement in security, making a more resilient organization. Humans have been the #1 target of organizational cyber attacks; however, security teams, organizations, vendors, and leaders have vilified them.

At Herd, they believe security should be led with empathy and care. Building trust amongst users that will drive their engagement in security. Building herd immunity from cyber attacks. Learn more at https://herdsecurity.io/

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

OpenClaw saga continues, React Native Community vulnerability, Notepad++ & GTIG targets IPIDEA proxy network / Intel Chat [#291]

LimaCharlie — Mon, 09 Feb 2026 13:00:31 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

OpenClaw, an open source AI agent formerly known as MoltBot and ClawdBot, has rapidly become the fastest-growing project on GitHub, amassing over 113,000 stars in under a week.
A critical vulnerability in the React Native Community CLI NPM package, tracked as CVE-2025-11953 with a CVSS score of 9.8, has been actively exploited in the wild since late December 2025, according to new findings by VulnCheck. JFrog article.
Following the disclosure in the Notepad++ v8.8.9 release announcement, further investigation confirmed a sophisticated supply chain attack that targeted the application's update mechanism.
Google, in coordination with multiple partners, has undertaken a large-scale disruption effort targeting the IPIDEA proxy network, which it identifies as one of the largest residential proxy networks globally.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Do you have a browser blind spot? With Cody Pierce from Neon Cyber / Defender Fridays [#290]

LimaCharlie — Fri, 06 Feb 2026 13:00:35 -0100

Most orgs have a major blind spot: the browser.

This week on Defender Fridays, we're joined by Cody Pierce, Co-Founder and CEO at Neon Cyber, to discuss why browser security remains a critical gap, from sophisticated phishing campaigns that bypass traditional controls to shadow AI tools operating outside your security perimeter.

Cody began his career in the computer security industry twenty-five years ago. The first half of his journey was rooted in deep R&D for offensive security, and he had the privilege of leading great teams working on elite problems. Over the last decade, Cody have moved into product and leadership roles that allowed him to focus on developing and delivering innovative and differentiated capabilities through product incubation, development, and GTM activities. Cody says he gets the most joy from building and delivering products that bring order to the chaos of cyber security while giving defenders the upper hand.

About This Session

This office hours format brings together the LimaCharlie team to share practical experiences with AI-powered security operations. Rather than theoretical discussions, we demonstrate working tools and invite the community to share their own AI security experiments. The session highlights the rapid evolution of AI capabilities in cybersecurity and explores the changing relationship between security practitioners and automation.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

PeckBirdy, ShinyHunters, OpenClaw (former Moltbot) impersonation & ELECTRUM / Intel Chat [#289]

LimaCharlie — Mon, 02 Feb 2026 15:07:20 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Researchers at Trend Micro have uncovered continued activity from China-aligned threat actors leveraging a cross-platform JavaScript-based command-and-control framework known as "PeckBirdy".
Silent Push has identified an extensive phishing campaign targeting over 100 organizations, attributed to the threat actor group ShinyHunters.
A malicious Visual Studio Code extension impersonating an AI coding assistant for OpenClaw (former Moltbot) has been discovered distributing malware via the official VS Code Extension Marketplace.
Dragos has attributed the December 2025 cyberattack on the Polish power grid to the Russian state-sponsored group known as ELECTRUM, with medium confidence.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Agentic SecOps Workspace (ASW) office hours with LimaCharlie / Defender Fridays [#288]

LimaCharlie — Fri, 30 Jan 2026 12:56:58 -0100

Join us for a special Defender Fridays Office Hours session where the LimaCharlie team demonstrates the new Agentic SecOps Workspace (ASW) and explores what's possible when AI agents operate security infrastructure directly.

What We'll Discuss

In this hands-on session, we showcase real working implementations of AI in cybersecurity operations. From reverse engineering malware to automated rule tuning and infrastructure management, we demonstrate how AI agents are transforming security workflows from concept to production-ready tools in hours instead of days.

Key Topics

Automated malware analysis and decompilation without traditional manual reverse engineering workflows
Rule tuning at scale: Investigating noisy detections, writing false positive rules, and deploying them autonomously
Infrastructure automation: Setting up data sources, configuring tenants, and managing security operations through AI agents
The permission model: Balancing AI capability with human oversight and approval workflows
Real-world applications: Custom reporting, detection coverage analysis, and operational time savings

About This Session

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes!

Sponsored by LimaCharlie

Why LimaCharlie?

Transparency: Complete visibility into every action and decision. No black boxes, no vendor lock-in.
Scalability: Security operations that scale like infrastructure, not like procurement cycles. Move at cloud speed.
Unopinionated Design: Integrate the tools you need, not just those contracts allow. Build security on your terms.
Agentic SecOps Workspace (ASW): AI agents that operate alongside your team with observable, auditable actions through the same APIs human analysts use.
Security Primitives: Composable building blocks that endure as tools come and go. Build once, evolve continuously.

Try the Agentic SecOps Workspace free: https://limacharlie.io

Learn more: https://docs.limacharlie.io

Follow LimaCharlie

LinkedIn: / limacharlieio

X: https://x.com/limacharlieio

Community Discourse: https://community.limacharlie.com/

Host: Maxime Lamothe-Brassard - CEO / Co-founder at LimaCharlie

No Going Back: AI Redefines SecOps for Service Providers (MSSP) with a panel of computer scientists and security practitioners [#287]

LimaCharlie — Wed, 28 Jan 2026 13:00:30 -0100

In this special episode of The Cybersecurity Defenders Podcast, a panel of cybersecurity experts discuss the irreversible changes AI has brought to the industry. This panel originally aired on January 20th, 2026.

The panel attendees include:

Christopher Luft (host) - Co-Founder / CCO, LimaCharlie
Maxime Lamothe-Brassard - Founder / CEO, LimaCharlie
Eric Capuano - Co-Founder, Digital Defense Institute
Joshua Neil - Co-Founder, Alpha Level
Kris Merritt - Advisor
Daniel Lees - Sr Staff Cloud Security Architect, Google

LimaCharlie has watched the AI SOC conversation unfold and stayed quiet. Until now.

Security vendors are racing to attach chatbots to legacy platforms and call it innovation. AI SOC startups have raised hundreds of millions to build better alert triage. Both approaches solve the same narrow problem: helping analysts click faster.

Service providers managing hundreds or thousands of tenants face a different reality. Alert triage matters, but so does deployment, configuration, detection engineering, reporting, and onboarding. The tedious work that eats margin and slows growth spans the entire operation.

What if AI could operate your entire security infrastructure with the same access as your best analyst?

We built LimaCharlie for complete programmatic access from day one. we were building for AI operators before AI operators existed. On January 20th, we'll show you what happens when AI agents can do everything in a security platform, across every tenant, through natural language.

No marketing theater. Just real conversations and a demonstration of AI-driven security operations where you stay in control.

Learn more at https://limacharlie.io/

Visual Studio Code malware, Sinkholes reversal, Chinese pen-testing & FortiSIEM zero-day / Intel Chat [#286]

LimaCharlie — Mon, 26 Jan 2026 14:14:29 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

North Korean threat actors are targeting macOS software developers in a new malware campaign that abuses Visual Studio Code (VS Code) confi gurations to deliver JavaScript-based backdoors, according to research from Jamf.
Sinkholes are usually seen as the end of a malicious campaign - the point where domains are seized and abuse stops.
China’s pen-testing and red-team ecosystem has always been hard to observe, especially since many teams stopped participating in international CTFs post-2018.
A critical zero-day vulnerability, CVE-2025-64155, has been discovered in Fortinet’s FortiSIEM platform by Horizon3.ai, allowing unauthenticated remote code execution and privilege escalation to root.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

The future of SOC leadership with John Hubbard from SANS Institute / Defender Fridays [#285]

LimaCharlie — Fri, 23 Jan 2026 16:59:44 -0100

This week on Defender Fridays, John Hubbard, SANS Institute Cyber Defense Curriculum Lead, discusses the future of security operations and what it means for SOC leaders today.

We'll be talking about:

Building continuous improvement into SOC leadership
Current vendor and product trends shaping security operations
AI's real impact on SOC jobs and operations

Few instructors combine real-world security operations center (SOC) leadership, curriculum design, and frontline defense experience like John Hubbard. As a Senior Instructor at the SANS Institute, author of SANS SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations, and co-author of SANS LDR551: Building and Leading Security Operations Centers, John translates years of frontline SOC leadership into practical lessons students can immediately apply. His courses give participants more than technical knowledge—they build the skills and judgment that ensure professionals thrive in modern security operations.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

This episode is brought to you by LimaCharlie, the world's first SecOps Cloud Platform (SCP). Build and customize your security stack like "lego blocks" with our flexible, API-first solution.

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Improve response times with automation and real-time capabilities

Try the SecOps Cloud Platform free: https://limacharlie.io

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

From AI SOC to AI in the SOC (and beyond) Ft. Mike Privette from Return on Security with Maxime Lamothe-Brassard from LimaCharlie [#284]

LimaCharlie — Thu, 22 Jan 2026 20:26:18 -0100

In this special episode of The Cybersecurity Defenders Podcast, Mike Privette hosts a keynote discussion with LimaCharlie Founder and CEO, Maxime Lamothe-Brassard.

LimaCharlie has watched the AI SOC conversation unfold and stayed quiet. Until now.

What if AI could operate your entire security infrastructure with the same access as your best analyst?

No marketing theater. Just real conversations and a demonstration of AI-driven security operations where you stay in control.

Learn more at https://limacharlie.io/

VoidLink, AsyncRat, Predator spyware & AI agents pose risk to enterprises / Intel Chat [#283]

LimaCharlie — Tue, 20 Jan 2026 17:23:12 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Security researchers at Check Point have uncovered a previously unknown Linux malware framework named VoidLink, which stands out for its complexity and modular design.
Researchers at Trend Micro have identified a new phishing campaign that combines legitimate services and open-source tools to distribute AsyncRAT, a commodity-remote access trojan.
New research into Predator spyware reveals a deeper level of sophistication and operational intelligence than previously understood.
The widespread adoption of AI agents in enterprise environments is creating a new class of identity and access control risks as highlighted in a new report from The Hacker News.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

Hiring fraud and deepfake AI with Tom Cross from GetReal Security / Defender Fridays [#282]

LimaCharlie — Fri, 16 Jan 2026 16:09:26 -0100

This week on Defender Fridays, Tom Cross, Head of Threat Research at GetReal Security, joins us to talk hiring fraud and deepfakes on our first Defender Fridays session of 2026!

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

This episode is brought to you by LimaCharlie, the world's first SecOps Cloud Platform (SCP). Build and customize your security stack like "lego blocks" with our flexible, API-first solution.

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Improve response times with automation and real-time capabilities

Try the SecOps Cloud Platform free: https://limacharlie.io

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

Ni8mare CVSS 10.0, malicious AI extensions, Venezuela blackout & guilty BlackCat insiders / Intel Chat [#281]

LimaCharlie — Wed, 14 Jan 2026 15:37:59 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A newly disclosed vulnerability in the workflow automation platform n8n, tracked as CVE-2026-21858 and rated CVSS 10.0, allows unauthenticated remote attackers to fully compromise exposed instances.
Two malicious Chrome extensions impersonating a legitimate product from AITOPIA were found exfiltrating sensitive user data, including full AI chat histories, according to a report from OX Security.
The recent U.S. military operation in Venezuela that led to the capture of President Nicolás Maduro may have included cyber operations, but official confirmation of cyber’s role remains ambiguous.
Two U.S. citizens with professional backgrounds in cybersecurity have pleaded guilty to acting as affiliates of the ALPHV/BlackCat ransomware group, a prominent ransomware-as-a-service (RaaS) operation.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

How AI is Re-Building the Cybersecurity Landscape with Max Lamothe-Brassard from LimaCharlie [#280]

LimaCharlie — Mon, 12 Jan 2026 14:24:26 -0100

On this episode of The Cybersecurity Defenders Podcast we're starting the new season off with the hottest topic of 2025: AI.

Sitting down with Maxime Lamothe-Brassard, Founder and CEO of LimaCharlie, we discuss the ways AI has rapidly changed how companies are building security tools.

Join an in-depth discussion January 20, 2026 and witness LimaCharlie's fundamentally different approach to AI-powered security operations. Your security operations will never be the same: https://www.linkedin.com/events/7401665070889545728/

Maxime Lamothe-Brassard began his cybersecurity career at the Canadian Department of National Defense before providing direct assistance to organizations facing cyber defense challenges. His career includes key roles at CrowdStrike and Google, as well as being part of Chronicle Security’s founding team, ultimately leading him to establish LimaCharlie to revolutionize security operations infrastructure.

Support our show and share your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#279 - 2025 Predictions for the Future of Cybersecurity with all our guests

LimaCharlie — Mon, 22 Dec 2025 15:26:04 -0100

On this episode of The Cybersecurity Defenders Podcast, we revisit the 2025 predictions shared by our guests throughout the year.

From attackers and defenders to AI and the broader security industry, these forecasts capture what experts expected was coming next. Rather than judging accuracy - which is still too early to assess -we're examining the predictions themselves: where they aligned, how they clustered, and what those patterns reveal about the industry’s mindset as this year came to a close. Free from hindsight bias, this episode explores what remained uncertain as we entered 2026.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#278 - Defender Fridays: Bug bounties, disclosures and real-world response with Bryan Brake from Amazon

LimaCharlie — Fri, 19 Dec 2025 14:01:37 -0100

This week on Defender Fridays, Bryan Brake, Senior Product Manager and Bug Bounty Team Lead at Amazon, joins us to discuss vulnerability remediation, bounty processes, and incident response workflows.

Bryan will share practical insights on managing disclosures and coordinating responses across security teams.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

This episode is brought to you by LimaCharlie, the world's first SecOps Cloud Platform (SCP). Build and customize your security stack like "lego blocks" with our flexible, API-first solution.

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Improve response times with automation and real-time capabilities

Try the SecOps Cloud Platform free: https://limacharlie.io

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

#277 - BlackGirlsHack: Building a community and impactful legacy with Rebekah Skeete

LimaCharlie — Wed, 17 Dec 2025 15:08:47 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Rebekah Skeete, Executive Director and CEO of BlackGirlsHack Foundation. Rebekah dives into how BGH is helping to increase diversity in cybersecurity by bridging the gap between what is taught in educational institutions and what is necessary for careers in cybersecurity.

For more information visit: https://www.blackgirlshack.org/Home

Rebekah Skeete is a Security Engineer with Schellman based in Dallas, Texas. As a member of the Infrastructure and Security team, Rebekah is part of a collaborative group of technology professionals serving as the primary technical resource to safeguard the organization's computer networks and systems. In her role, she is responsible for planning and carrying out security measures to monitor and protect sensitive data and systems from infiltration and cyber-attacks.

Prior to joining Schellman in 2022, Rebekah worked for the Texas Rangers in a myriad of roles, including Cybersecurity Analyst and Manager of IT Applications and Operations. During the construction of the Rangers new state-of-the-art ballpark, Globe Life Field, Rebekah assisted the Rangers IT department’s efforts to transition over 200 front office employees to their new workspaces.

Outside baseball and IT, Rebekah is also interested in politics and started volunteering for campaigns in 2008. From 2013-2016, she served as a Campaign Manager in the Dallas-Fort Worth area. In 2015, she attended the Women’s Campaign School at Yale.

Rebekah is the COO of BlackGirlsHack, a nonprofit organization providing black women with resources, training, mentoring, and access to increase representation and diversity in the cybersecurity field. Committed to inclusion and belonging, she holds the firm belief that representation enhances the culture and community of an organization and seeks to amplify underserved voices at any table she has a seat.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#276 - Intel Chat: React2Shell, GeminiJack vulnerability, pro‑Russia hacktivist arrested & Warp Panda

LimaCharlie — Mon, 15 Dec 2025 14:44:05 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

For for more information about Cybersecurity Cares, visit cybersecurity-cares.com

React2Shell is the latest high-profile vulnerability in the web application landscape, scoring a critical CVSS 10.0 and drawing immediate comparisons to Log4Shell.
Researchers at Noma Labs disclosed a critical vulnerability in Google's Gemini Enterprise AI assistant, dubbed GeminiJack, that allowed attackers to stealthily exfiltrate sensitive enterprise data.
U.S. prosecutors have charged Victoria Eduardovna Dubranova, a 33‑year‑old Ukrainian woman, in two separate indictments for her alleged involvement with pro‑Russia hacktivist groups CyberArmyofRussia_Reborn and NoName057(16).
A China-aligned threat actor identified as Warp Panda has been linked to recent compromises of VMware vCenter environments at U.S.-based organizations, according to a new report from CrowdStrike. Original CrowdStrike article. CISA BRICKSTORM Backdoor breakdown. Analysis report.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#275 - Defender Fridays: Polymorphic Panic - Debunking the AI Malware Myth with Randy Pargman from Proofpoint

LimaCharlie — Fri, 12 Dec 2025 14:03:46 -0100

Join us for this week's Defender Fridays as we explore the reality of AI-powered malware threats with Randy Pargman, Senior Director of Threat Detection at Proofpoint.

In this episode, Randy challenges the hype around AI-powered polymorphic malware and examines how threat actors actually operate in practice. He discusses why defenders should focus on real-world threats rather than theoretical sophisticated attacks.

Key Topics:

The gap between AI malware hype and practical reality
Why threat actors prefer simple, effective methods over sophisticated techniques
The prevalence of legitimate RMM tools in modern attacks
Building practical detection strategies for actual threats
Lessons from physical security that apply to cybersecurity defense

Randy Pargman is Senior Director of Threat Detection at Proofpoint, where he leads detection engineering, sandbox development, and threat actor tracking initiatives.

Subscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!

This episode is brought to you by LimaCharlie, the world's first SecOps Cloud Platform (SCP). Build and customize your security stack like "lego blocks" with our flexible, API-first solution.

Eliminate vendor sprawl and tool complexity
Deploy and scale effortlessly on native multi-tenant architecture
Reduce costs with intelligent data routing and free 1-year retention
Build custom solutions with 100+ security capabilities on-demand
Improve response times with automation and real-time capabilities

Try the SecOps Cloud Platform free: https://limacharlie.io

Host: Maxime Lamothe-Brassard - Founder at LimaCharlie

#274 - Why most SOCs are failing (and how to fix them) with Alec Fenton from Foresite Cybersecurity

LimaCharlie — Wed, 10 Dec 2025 13:00:33 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Alec Fenton, VP of Security Operations at Foresite Cybersecurity about his journey from SOC analyst to security leader.

Alec Fenton is a seasoned Cyber Security professional with over 15 years of extensive experience across many IT domains. With a career spanning more than a decade, Alec has honed his expertise in addressing a broad spectrum of cybersecurity challenges, leveraging his analytical prowess and hands-on approach to leadership.

Throughout his career, Alec has navigated the intricate landscape of IT security, working across various sectors including managed service providers and private companies. His tenure as an analyst in the cybersecurity space has not only equipped him with a deep understanding of emerging threats and vulnerabilities but has also shaped his leadership philosophy of "lead from the front."

Alec's commitment to excellence and his unwavering dedication to staying ahead of the curve in the ever-evolving field of cybersecurity have earned him recognition as a trusted advisor and thought leader in the industry. When he's not immersed in the world of IT security, Alec enjoys spending time outdoors, and help coach his son's baseball/basketball teams.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#273 - Intel Chat: Tomiris cyber-espionage group, OpenPLC ScadaBR flaw, NPM manipulating AI-driven scanners & MuddyWater

LimaCharlie — Tue, 09 Dec 2025 00:37:20 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

For for more information about Cybersecurity Cares, visit cybersecurity-cares.com

The Tomiris cyber-espionage group, which has been under Kaspersky's watch since 2021, has evolved its tactics in a new wave of attacks observed in early 2025. Article #2.
CISA has recently added CVE-2021-26829 to its known exploited vulnerabilities, or KEV catalog, marking it as a confirmed threat based on real world exploitation.
Researchers at KOI Security have identified a malicious NPM package, which not only performs typical credential stealing behavior, but also includes a new, subtle tactic attempting to manipulate AI-driven security scanners via embedded prompt engineering. Article #2.
Iranian state sponsored threat group MuddyWater has launched a new wave of cyber espionage attacks targeting Israeli organizations across sectors including academia, civil infrastructure, engineering, technology and utilities.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#272 - Intel Chat: AI taking over low-skilled work, AI-orchestrated cyber espionage, JackFix & weaponizing Blender files

LimaCharlie — Mon, 01 Dec 2025 15:55:59 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

For for more information about Cyber Security Cares, visit cybersecurity-cares.com

AI is now fulfilling a long-standing hope of security teams: it’s taking over repetitive, low-skill tasks like log reviews, alert triage, and basic investigations.
Anthropic has disclosed what it believes is the first documented case of a largely autonomous AI-orchestrated cyber espionage campaign.
The new "JackFix" variant of the ClickFix attack is gaining traction, and unlike its predecessors, it combines both social engineering and technical evasion tactics to bypass existing defenses more effectively.
Researchers at Morphisec have uncovered a new six-month-long campaign weaponizing .blend files - native to Blender, the open-source 3D modeling software - to deliver a variant of the StealC information stealer.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#271 - AI hype & the future of SecOps, what’s changed in 30 years? With Erik Bloch from Illumio

LimaCharlie — Wed, 26 Nov 2025 16:09:04 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Erik Bloch, VP of Security at Illumio, about better tools to combat burnout rate and discuss the reality of AI in security.

Erik Bloch has 30+ years of information and cyber security experience, both as an IC and as a leader of teams. “People first” has always been his approach. He has led entire security and IT functions at smaller companies, and been the CISOs leading big teams at larger orgs.

Erik also spent time on the product side, trying to make better tooling for people like him. With a mix of security, IT and product under his belt, Erik is at a place where connections, making meaningful change and driving impact in peoples lives, mean a lot to him. The smartest person he knows once said "Problems are really opportunities in disguise", and that's something Erik always tries to see.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#270 - Defender Fridays: Zero Trust with Dr. Chase Cunningham from Demo-Force

LimaCharlie — Fri, 21 Nov 2025 15:58:36 -0100

Dr. Cunningham created the influential Zero Trust Extended (ZTX) Framework at Forrester Research, playing a key role in accelerating global adoption of Zero Trust principles across industries and governments worldwide.

#269 - How AI offers defenders even more growth opportunities with Michael Baker from DXC Technology

LimaCharlie — Wed, 19 Nov 2025 15:22:35 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Michael Baker, VP, Global Chief Information Security Officer at DXC Technology, about his optimistic outlook on the impact of AI in cybersecurity.

Michael Baker is an accomplished cyber security executive with more than 24 years of experience in the field. He is passionate about building high-performing teams and transforming the way cyber risk is managed within businesses. Currently, Michael serves as the Global Chief Information Security Officer (CISO) for DXC Technology. In this capacity, he is responsible for protecting the brand and reputation of DXC Technology, a $14 billion global technology enterprise with 130,000 employees located across 80+ territories.

Before joining DXC Technology, he held various leadership positions, including CISO, within the US government contracting and aerospace and defense industry, along with a long career serving clients as a cyber security and risk management consultant. Michael is known for his strategic vision, global program management, and ability to drive operational excellence across end-to end cyber services that provide measurable business value. Visit dxc.com for more info.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#268 - Intel Chat: LLM integration in malware, Android spyware family LandFall, Windows kernel zero-day flaw & Ex-L3Harris executive sells trade secrets

LimaCharlie — Mon, 17 Nov 2025 13:13:03 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Google’s Threat Intelligence Group has observed a significant shift in 2025, threat actors are no longer using AI to just speed up operations, they are now integrating LLMs directly into the malware.
Unit 42 has identified a previously undocumented Android spyware family, named LandFall, discovered during an investigation into iOS exploit chains involving malicious DNG images.
Microsoft’s November Patch Tuesday rollout includes fixes for over 60 vulnerabilities, one of which is a zero-day privilege escalation flaw in the Windows kernel that has already been exploited in the wild.
Former executive at L3Harris Trenchant, Peter Williams, has pleaded guilty in U.S. federal court to selling 8 trade secrets valued at over 1.3 million to a Russian-based software broker involved in the zero-day exploit market.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#267 - Defender Fridays: AI in SecOps - what's real vs. what's hype? With Alec Fenton from Foresite Cybersecurity

LimaCharlie — Fri, 14 Nov 2025 14:11:40 -0100

In this episode of Defender Fridays, we talk to Alec Fenton, VP Security Operations at Foresite Cybersecurity, practical career advice for defenders, SOC metrics that actually matter and AI in security operations.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Alec is a seasoned Cyber Security professional with over 15 years of extensive experience across many IT domains. With a career spanning more than a decade, Alec has honed his expertise in addressing a broad spectrum of cybersecurity challenges, leveraging his analytical prowess and hands-on approach to leadership.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#266 - Preparing for Out-of-Band Communication in Incident Response with Navroop Mitter from ArmorText

LimaCharlie — Wed, 12 Nov 2025 13:00:26 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Navroop Mitter, CEO of ArmorText, about the role of Out-of-Band (OOB) communication in cyber incident response.

ArmorText Named a Leader in The Forrester Wave™: Secure Communications Solutions, Q3 2024

Cyber Resilience: Incident Response Tabletop Exercises

Navroop Mitter is the CEO of ArmorText, a mobile security and privacy company based in the Washington, D.C. area.

Before founding ArmorText, Navroop was a Senior Manager in Accenture’s North American Security Practice, where he built and led information security programs across multiple regions. He helped double Accenture’s Scandinavian security practice within a year and established the firm’s first near-shore security delivery center in Argentina, hiring and training over 30 practitioners in under 30 days.

Navroop has led large-scale international security engagements, working across cultures and time zones to strengthen teams in the U.S., India, and abroad. Recognized for his entrepreneurial mindset and expertise in identity and access management, he became one of Accenture’s most sought-after leaders for complex, multi-country security initiatives.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#265 - Intel Chat: AWS TruffleNet exploit, React Native vulnerability, SesameOp OpenAI Assistants API C2 channel & Operation SkyCloak

LimaCharlie — Mon, 10 Nov 2025 15:59:47 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A newly observed threat campaign is exploiting Amazon Web Services' Simple Email Service using stolen credentials and open source tools to perform cloud reconnaissance and eventually launch Business Email Compromise scams.
A critical vulnerability has been disclosed in the React Native Community CLI NPM package, a toolset widely used for building React Native applications.
Microsoft's Detection and Response Team (DART) has discovered a novel backdoor, SesameOp, that uses the OpenAI Assistants API as a command-and-control (C2) channel, highlighting a new way attackers are misusing generative AI platforms.
Researchers from Cyble and Seqrite Labs have disclosed a sophisticated malware campaign, dubbed Operation SkyCloak, targeting defense-related organizations in Russia and Belarus through weaponized attachments delivered via phishing emails.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#264 - Defender Fridays: Dive into SaaS Intrusion Trends with Julie Agnes Sparks from Datadog

LimaCharlie — Fri, 07 Nov 2025 16:13:45 -0100

In this episode of Defender Fridays, LimaCharlie Founder Maxime Lamothe-Brassard talks to Julie Agnes Sparks, Security Engineer at Datadog, about how to maximize logging visibility for effective detection engineering.

Julie has a passion for continuous learning, proactively detecting significant security events, and responding effectively. Interests include: diversity & inclusion, privacy, and making technology more accessible.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#263 - Intel Chat: BlackBasta, BlueNoroff, Operation ForumTroll & Aisuru

LimaCharlie — Mon, 03 Nov 2025 16:30:23 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

The UK Information Commissioner's Office (ICO) recently released a comprehensive 136-page report detailing the BlackBasta ransomware attack on Capita in March 2023.
Kaspersky researchers have detailed two active campaigns from North Korean APT group BlueNoroff, which continue the group’s long-running SnatchCrypto operation targeting individuals in financial and tech sectors.
The exploitation of the first Chrome zero-day of 2025 has been attributed to a state-sponsored threat actor involved in Operation ForumTroll, a cyber-espionage campaign targeting Russian entities across sectors like education, finance, media, and government.
Netscout has identified a newly emerging Internet of Things (IoT) botnet, Aisuru, which has already launched distributed denial-of-service (DDoS) attacks exceeding 20 Tbps, placing it among the most powerful botnets observed to date.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#262 - Defender Fridays: What does "AI-ready SOC" actually mean? With Dr. Anton Chuvakin from CISO, Google Cloud

LimaCharlie — Fri, 31 Oct 2025 14:08:27 -0100

Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud and a recognized expert in SIEM, log management, and PCI DSS compliance, will help us cut through the buzzwords and discuss modern security operations.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Dr. Chuvakin is now involved with security solution strategy at Google Cloud, where he arrived via Chronicle Security (an Alphabet company) acquisition in July 2019. He is also a co-host of Cloud Security Podcast.

Until June 2019, Dr. Anton Chuvakin was a Research VP and Distinguished Analyst at Gartner for Technical Professionals (GTP) Security and Risk Management Strategies (SRMS) team. At Gartner he covered a broad range of security operations and detection and response topics, and is credited with inventing the term "EDR."

He is a recognized security expert in the field of SIEM, log management and PCI DSS compliance. He is an author of books "Security Warrior", "PCI Compliance", "Logging and Log Management" and a contributor to "Know Your Enemy II", "Information Security Management Handbook" and others. Anton has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI DSS, honeypots, etc. His blog securitywarrior.org was one of the most popular in the industry.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#261 - Scaling MSP & MSSP Services with Hannah Lloyd, Co-Founder / CRO of enhanced.io

LimaCharlie — Wed, 29 Oct 2025 09:00:28 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Hannah Lloyd, Co-Founder and CRO of enhanced.io, about how MSPs can launch, sell and scale security offerings.

With 10+ years of channel sales experience, Hannah leads global new business generation and account management to deliver innovative cybersecurity solutions to enhanced.io’s MSP partners. As a GTIA EC member (2018) and Chair (2021), Hannah is actively involved in the MSP channel community.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#260 - Intel Chat: Kansas City National Security Campus breach, COLDRIVER, new KEV catalog additions & AWS outage

LimaCharlie — Mon, 27 Oct 2025 13:06:19 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A breach at the Kansas City National Security Campus (KCNSC), a facility responsible for manufacturing roughly 80% of the non-nuclear components for U.S. nuclear weapons, was enabled by two critical Microsoft SharePoint vulnerabilities.
COLDRIVER, a Russian state-sponsored group also tracked as UNC4057, Callisto, or Star Blizzard, has shifted rapidly toward new malware development following the public exposure of its previous malware, LOSTKEYS, in May 2025.
CISA has officially added three newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, urging swift remediation efforts across federal environments. Newer article link.
Amazon Web Services (AWS) experienced a major outage on October 20th that impacted thousands of applications globally, disrupting operations for companies and end-users alike.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#259 - Defender Fridays: Breaking Down Microsoft Defender for Endpoint with Ken Westin from LimaCharlie

LimaCharlie — Fri, 24 Oct 2025 16:33:59 +0000

Ken, Senior Solutions Engineer at LimaCharlie, dives into the incredibly confusing licensing tiers, pricing models and feature sets for Microsoft Defender for Endpoint. Today we discuss:

The difference between tiers
Ways to solve Defender visibility issues and increase operational transparency
How its capabilities can be customized and expanded for better flexibility and scalability for service providers

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

A big picture thinker, Ken ferrets out trends, seeking to understand what happens when businesses are breached and the methods behind the attacks. Then he figures out how to protect customers before they’re hit.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastruture for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at limacharlie.io.

#258 - Intel Chat: Oracle EBS, Storm-2603, North Korean IT infiltration & LLM poisoning study

LimaCharlie — Mon, 20 Oct 2025 13:00:25 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

CrowdStrike is tracking a mass exploitation campaign leveraging a previously unknown vulnerability in Oracle E-business suite or EBS.
A threat group, tracked as Storm-2603, has been observed using the open source Velociraptor DFIR tool as part of it’s post-exploitation toolkit in recent ransomware attacks.
North Korean IT workers, operating under state direction, continue to infiltrate international tech companies using false identities and anonymizing infrastructure to secure jobs and route payments in cryptocurrency.
Researchers from Anthropic, the UK AI Security Institute, and Alan Turing Institute have released the largest study to date on poisoning attacks during pre-training on large language models or LLMs.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#257 - Defender Fridays: Using Honeyfiles to Detect Adversaries with Zane Gittins from Meissner Filtration Products

LimaCharlie — Mon, 20 Oct 2025 03:14:08 +0000

Zane demonstrates deploying honeyfiles via Velociraptor and discuss deception techniques for early detection of compromise. Learn how decoy files can serve as tripwires for infostealers and adversaries in your environment. Watch on YouTube for better visuals.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#256 - Intel Chat: RediShell, Cisco zero-day vulnerability, AI voice cloning tech, Brickstorm & pro-Russia teen hackers arrested

LimaCharlie — Mon, 13 Oct 2025 13:00:29 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A newly disclosed vulnerability in Redis, dubbed RediShell and tracked as CVE-2025-49844, affects all Redis versions and carries a maximum CVSS score of 10.0.

Cisco has disclosed a critical zero-day vulnerability—CVE-2025-20352—affecting its widely deployed IOS and IOS XE software, confirming active exploitation in the wild.
Researchers at NCC Group have found that voice cloning technology has reached a level where just five minutes of recorded audio is enough to generate convincing voice clones in real time.
A China-linked cyber-espionage group, tracked as UNC5221, has been systematically targeting network infrastructure appliances that lack standard endpoint detection and response (EDR) support.
Dutch authorities have arrested two 17-year-old boys suspected of being recruited by pro-Russian hackers to carry out surveillance activities.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#255 - Defender Fridays: Identity Automation in the Age of Agentic AI with Matthew Chiodi from Cerby

LimaCharlie — Fri, 10 Oct 2025 13:00:24 +0000

Matt, Chief Strategy Officer at Cerby, discusses how the autonomous AI agents create a demand for a fresh approach to identity security and shares practical insights on navigating these new challenges.

Join the Defender Fridays community, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals.

Matt has spent 20+ years at the intersection of cybersecurity, strategy, and company building. His career began in the trenches as a practitioner and architect, grew into CISO and CSO roles, and today he helps scale Cerby as Chief Strategy Officer.

At Cerby, Matt has been part of the journey from pre-launch through significant enterprise adoption, serving first as Founding Advisor, then Chief Trust Officer, COO, and now CSO. Each role reflected a different stage of building the company: establishing trust and market credibility, creating the operations foundation, and shaping long-term strategy and growth.

Before Cerby, as part of the early RedLock team, Matt helped scale Prisma Cloud (formerly RedLock) from $4M to $500M+ ARR after Palo Alto Networks’ $235M acquisition. That experience taught him how to scale security businesses from the ground up while staying connected to practitioner needs.

Matt believes the best security leaders shouldn’t have to choose between protecting and growing the business; his work is helping organizations achieve both.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#254 - Roadmap to Community Cyber Defense with Sarah Powazek, Program Director of Public Interest Cybersecurity, UC Berkeley CLTC

LimaCharlie — Wed, 08 Oct 2025 10:00:24 +0000

On this episode of The Cybersecurity Defenders Podcast we speak with Sarah Powazek about the Roadmap to Community Cyber Defense. Diving into the report, Sarah emphasizes the need for low-resource organizations and cyber experts to come together in a co-responsibility model for cyber defense.

Learn more about the UC Berkeley Center for Long-Term Cybersecurity (CLTC).

Get help or join the Cyber Resilience Corps here.

Read the roadmap.

Sarah leads flagship research on defending low-resource organizations like nonprofits, municipalities, and schools from cyber attacks. She serves as Co-Chair of the Cyber Resilience Corps and is also Senior Advisor for the Consortium of Cybersecurity Clinics, advocating for the expansion of clinical cyber education around the world. Sarah hosts the Cyber Civil Defense Summit, an annual mission-based gathering of cyber defenders to protect the nation’s most vulnerable public infrastructure. Sarah previously worked at CrowdStrike Strategic Advisory Services, and as the Program Manager of the Ransomware Task Force.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#253 - Defender Fridays: Building the Strelka File Scanning System with Josh Liburdi from DoorDash

LimaCharlie — Fri, 03 Oct 2025 16:25:21 +0000

Josh Liburdi, Principal Engineer of Security Operations at DoorDash, joins Maxime Lamothe-Brassard, LimaCharlie CEO / Founder, to talk about building the Strelka file scanning system.

As a security engineer who works in security operations (prevention, detection, and response), Josh has more than a decade of industry experience and has worked at several diverse organizations, including Brex, Target, and CrowdStrike.

He also presents at information security conferences (BSides NYC & SF, SANS, fwd:cloudsec), is a published author (Bluenomicon from Splunk, Huntpedia from Sqrrl), and is active in the open source security community with contributions to many projects, including Substation at Brex (creator), Strelka at Target (creator), and the Zeek network analysis framework.

Join Defender Fridays, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals. Become part of the LimaCharlie Community.

Learn more about LimaCharlie at limacharlie.io.

#252 - Intel Chat: Secret Service SWAT Infrastructure, Nimbus Manticore, malicious ads targeting macOS, SpamGPT & GitHub NPM changes

LimaCharlie — Mon, 29 Sep 2025 20:53:58 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A recent investigation by the U.S. Secret Service claims to have uncovered a massive swatting infrastructure centered around New York City.
Check Point researchers are tracking an Iran-linked cyber-espionage group known as Nimbus Manticore, which appears to be expanding its operations into Western Europe.
A new wave of malicious advertising is targeting macOS users by impersonating widely used software and services through search engine ads.
A new tool called SpamGPT is drawing attention in the cybersecurity community for effectively lowering the barrier to entry for large-scale spam and phishing campaigns.
In light of increasing attacks on open source ecosystems, GitHub has disclosed recent security incidents affecting the npm registry, including the Shai-Hulud worm.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#251 - Defender Fridays: Hunting Chinese State Actors with David Burkett from Corelight

LimaCharlie — Fri, 26 Sep 2025 16:21:21 +0000

Maxime Lamothe-Brassard, LimaCharlie CEO / Founder, and our Defender Fridays community sat down with David Burkett to discuss hunting Chinese State Actors with the Latest CISA Joint Advisory.

David’s expertise is backed by a strong set of GIAC certifications, including GCTI, GCIA, GPYC, and GCED... among others. He is proud to have been part of a large overall security team that won the prestigious James S. Cogswell Outstanding Industrial Security Achievement Award from the Defense Counterintelligence and Security Agency. Their security operations center was recognized as being among the top 1% of cybersecurity programs for all cleared facilities.

In addition to his hands-on experience, David has consulted for over 40 Fortune 500 Companies and Large Federal Organizations, helping them manage their SOAR platforms and playbooks. As a strong believer in knowledge sharing and collaboration, he is also an active contributor to the open-source detection security project known as Sigma.

David is constantly seeking opportunities to grow and learn, and is eager to connect with like-minded professionals in the cybersecurity domain. Let's connect and build a safer digital world together.

Join Defender Fridays, live every Friday, to discuss the dynamic world of information security in a collaborative space with seasoned professionals. Become part of the LimaCharlie Community.

#250 - Intel Chat: PromptLock, "Shai-Hulud", EdisonWatch & FileFix campaign

LimaCharlie — Mon, 22 Sep 2025 16:31:23 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

ESET Research has uncovered what it believes to be the first documented case of AI-powered ransomware, dubbed PromptLock.
Multiple CrowdStrike-branded npm packages were recently discovered to be compromised, marking a new wave in the ongoing “Shai-Hulud” supply chain attack campaign.
Researchers at AI security firm EdisonWatch have uncovered a new vulnerability in the ChatGPT calendar integration, revealing how it can be exploited to execute attacker-controlled commands.
The most mature and globally distributed FileFix campaign observed to date is now active in the wild, according to researchers at Acronis.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#249 - Defender Fridays: Security State of Affairs with Cliff Janzen, CISO and VP of Security Services at Arctiq

LimaCharlie — Fri, 19 Sep 2025 17:00:26 +0000

LimaCharlie CEO, Max Lamothe-Brassard welcome Cliff Janzen, CISO and VP of Security Services at Arctiq, for a special "Security Potpourri" session!

What's on the menu?

SOC operations and optimization
Security automation strategies
Penetration testing insights

All through Cliff's expert lens and real-world experience. Join us for an insightful discussion on the current security landscape!

Cliff is an experienced Vice President of Security with a demonstrated history of working in the computer and network security industry. Skilled in Security Architecture, Governance, Incident Management, Ethical Hacking, and Intrusion Detection. Currently working as CISO and VP of Security Services at Arctiq.

#248 - Predictive vs. Reactive Cybersecurity with Robert Boles, Founder / CEO of BLOKWORX

LimaCharlie — Wed, 17 Sep 2025 16:00:26 +0000

On this episode of the Cybersecurity Defenders Podcast we speak with Robert Boles, Founder / CEO of BLOKWORX.

A veteran of the U.S. Marine Corps, Rob founded BLOKWORX in 2006 to further his passion for creating fast, secure networks. Since 1999 Rob was a core technical contributor and presenter on an Advanced IP Team, delivering bleeding edge WAN and Managed Security services to Small, Mid-level and Fortune 500 businesses around the world.

The experience led him back to the same conclusion, regardless of size and resources, every company struggled with the same uncertainty – multiple vendors with infinite solutions, and no real clarity how to make it all “work.” Rob focused BLOKWORX on security, reliability, and positive user experience. He has built a team that leverages their expertise with extensive research and testing, alignment with vendors, partners, and clients, and the experience of 1000’s of nodes managed and monitored, all supported by a mature delivery model built on years of operational experience. Rob is an avid outdoorsman and his favorite place to be is in a raft or a kayak with his son Jack.

Learn more at blokworx.com.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#247 - Intel Chat: JavaScript high-profile phishing, Red Sea cable cutting, Contagious Interview campaign & Salty2FA

LimaCharlie — Mon, 15 Sep 2025 18:08:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A high-profile phishing incident has resulted in the compromise of several widely-used JavaScript packages on npm, after a developer known as "Qix" inadvertently clicked a malicious link from a fake support email.
Multiple undersea cable cuts in the Red Sea have led to degraded internet connectivity across the Middle East and South Asia, affecting key infrastructure and cloud services.
North Korean-aligned threat actors operating under the Contagious Interview campaign have been systematically abusing cyber threat intelligence (CTI) platforms to monitor exposure of their own infrastructure and scout for new assets.
Researchers from Ontinue have detailed a sophisticated phishing campaign leveraging the Salty2FA phishing kit - a framework that reflects how cybercriminal tooling is increasingly mimicking enterprise-grade software in terms of design, capability, and operational maturity.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#246 - Defender Fridays: AI in the SOC with Matt Bromiley from Prophet Security

LimaCharlie — Fri, 12 Sep 2025 21:09:37 +0000

Matt Bromiley breaks down how AI is transforming (and should be transforming) SOC workflows. Whether you're already using AI tools or wondering where to start, this is the conversation you don't want to miss.

Matt is a security engineer at Prophet Security, refining Prophet AI to enhance automated alert triage, investigation, and response. His work ensures that customers can cut through the noise and focus on real threats - without getting bogged down by manual analysis. Learn more at prophetsecurity.ai

Matt is a cybersecurity leader and educator with over 14 years of experience leading incident response efforts and advancing detection and response capabilities across enterprise environments. His career has spanned hands-on operations, high-pressure breach response, and the strategic development of scalable cybersecurity programs.

Matt also serves as an instructor with the SANS institute, delivering advanced training in incident management and host- and network-based incident response.

On Defender Fridays we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

Join the live discussions by registering at limacharlie.io/defender-fridays

#245 - Intel Chat: Salt Typhoon, Scattered LapSus Hunters, WhatsApp vulnerability & AI-assisted compromise

LimaCharlie — Mon, 08 Sep 2025 22:25:47 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

The Salt Typhoon cyber campaign, attributed to Chinese state-backed hackers, has been declared a national defense crisis by the FBI and allied intelligence agencies.
A group identifying itself as “Scattered LapSus Hunters” has posted a threat on Telegram demanding that Google terminate two of its employees.
A newly discovered WhatsApp vulnerability, now tracked as CVE-2025-55177, has triggered urgent security advisories, particularly for iPhone users.
More than 1,000 developers were compromised in just over four hours on August 26 during an unprecedented, AI-assisted software supply chain attack targeting the npm ecosystem.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#244 - Intel Chat: Trend Micro Apex One, PyPI domains, RingReaper & Openbaar Ministrie attack

LimaCharlie — Mon, 01 Sep 2025 19:52:16 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

CISA has added CVE-2025-54948, a critical vulnerability in Trend Micro Apex One, to its Known Exploited Vulnerabilities (KEV) catalog, signaling that the flaw has been actively exploited in the wild.
PyPI has introduced new security measures to detect and respond to expired domains tied to user accounts, aiming to shut down a known supply chain attack vector: domain resurrection.
A recently discovered post-exploitation tool named RingReaper is gaining attention for its sophisticated evasion strategy: abusing the Linux kernel’s io_uring interface to operate undetected by standard endpoint detection and response (EDR) systems.
A cyberattack on the Netherlands’ Openbaar Ministerie (OM), the Public Prosecution Service, has unexpectedly disrupted speed enforcement across the country.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#243 - Defender Fridays: Detection prioritization via the BloodHound attack graph with Jared Atkinson, CTO at SpecterOps

LimaCharlie — Fri, 29 Aug 2025 16:45:13 +0000

Maxime Lamothe-Brassard, Founder and CEO of LimaCharlie, and the Defender Fridays community sit down with Jared Atkinson and dive into BloodHound.

Jared is a security researcher who specializes in Digital Forensics and Incident Response. Recently, he has been building and leading private sector Hunt Operations capabilities. In his previous life, Jared lead incident response missions for the U.S. Air Force Hunt Team, detecting and removing Advanced Persistent Threats on Air Force and DoD networks. Passionate about PowerShell and the open source community, Jared is the lead developer of PowerForensics, Uproot, and maintains a DFIR focused blog at www.invoke-ir.com.

Join the live discussions by registering at https://limacharlie.io/defender-fridays

#242 - Building human & AI synergy with Peter Ruta, Founder / CEO of Arcanna.ai

LimaCharlie — Wed, 27 Aug 2025 21:33:15 +0000

On this episode of the Cybersecurity Defenders Podcast we speak with Peter Ruta, Founder / CEO, Arcanna.ai.

Peter is a Romanian-born entrepreneur and technology expert with over 13 years of experience in the industry. His interest in technology was sparked after following a military path, and he went on to secure key jobs in prominent tech companies such as Cisco. In 2015, Peter decided to pursue his passion for entrepreneurship and founded Siscale AI INC. He then went on to develop Arcanna AI, a product that leverages the latest advancements in artificial intelligence to deliver cutting-edge solutions to clients.

Alongside his highly knowledgeable team, Peter has successfully grown Siscale AI into a thriving company with a strong reputation for innovation and excellence. Throughout his career, Peter has been recognized for his inquisitive, analytical mind and his ability to grasp complex situations quickly. He is known for his professionalism, results-oriented approach, and unwavering determination in the face of challenges. Peter is a natural leader who inspires his team to achieve their full potential and never loses sight of his goals.

Learn more at https://www.arcanna.ai/

#241 - Intel Chat:Apache ActiveMQ, Elastic EDR vulnerability, kernel-level EDR killers & PipeMagic

LimaCharlie — Tue, 26 Aug 2025 01:25:08 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

• Attackers are actively exploiting CVE-2023-46604, a remote code execution vulnerability in Apache ActiveMQ first disclosed in October 2023, that is used to compromise cloud-hosted Linux servers.

• AshES Cybersecurity has publicly disclosed a critical zero-day vulnerability in Elastic’s Endpoint Detection and Response (EDR) platform, specifically in the Microsoft-signed kernel driver elastic-endpoint-driver.sys.

• At least a dozen ransomware groups are now deploying kernel-level EDR killers - tools designed specifically to disable endpoint detection and response solutions - as part of their malware arsenal.

• Microsoft has released an in-depth technical analysis of PipeMagic, a modular backdoor linked to ransomware operations carried out by Storm-2460, a financially motivated threat group associated with RansomEXX.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#240 - Defender Fridays: Remote Management Tool Abuse with Ezra Woods, Security Engineer at Grand Canyon Education

LimaCharlie — Sat, 23 Aug 2025 05:06:26 +0000

Ezra Woods, Security Engineer at Grand Canyon Education, shares insights on current attack trends and practical defensive strategies you can use to protect your environment with Maxime Lamothe-Brassard, Founder and CEO of LimaCharlie, and the Defender Fridays community.

Join the live discussions by registering at https://limacharlie.io/defender-fridays

#239 - Intel Chat: Scattered Spider or ShinyHunters, Linux kernel’s eBPF subsystem, MAPP & BlackSuit ransomware group

LimaCharlie — Tue, 19 Aug 2025 22:15:31 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

• Recent reporting from DataBreaches has added yet another twist to the attribution puzzle between Scattered Spider and ShinyHunters. https://databreaches.net/2025/08/03/are-scattered-spider-and-shinyhunters-one-group-or-two-and-who-did-france-arrest/

• A recent disclosure on the oss-security mailing list detailed a set of 11 vulnerabilities in the Linux kernel’s eBPF subsystem, originally reported by security researcher “Van1sh” to both the kernel security team and the linux-distros list on July 19. https://www.openwall.com/lists/oss-security/2025/08/03/1

• Microsoft’s Microsoft Active Protections Program, or MAPP, is designed to shorten the time between vulnerability discovery and patch deployment by giving trusted security vendors early access to vulnerability details. https://nattothoughts.substack.com/p/when-privileged-access-falls-into

• US law enforcement, in coordination with multiple international partners, has taken action against the BlackSuit ransomware group — also known as Royal — resulting in the seizure of four servers, nine domains, and approximately $1 million in cryptocurrency. https://www.darkreading.com/vulnerabilities-threats/blacksuit-ransomware-infrastructure-law-enforcement

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#238 - Defender Fridays: Building trusted ecosystems for incident response with Dr. Mike Saylor, CEO of Blackswan Cybersecurity

LimaCharlie — Fri, 15 Aug 2025 16:00:32 +0000

Christopher Luft, Co-Founder and CCO of LimaCharlie, and Dr. Mike Saylor, CEO of Blackswan Cybersecurity, sat down with the Defender Fridays community for Black Hat week wrap up and a deep dive building secure environments for IR.

Dr. Mike Saylor is an accomplished, outcome-driven and solution-focused business professional and entrepreneur with 30+ years of Consulting, IT Audit & Risk, Cyber Security & Incident Response experience. Uniquely qualified as a leader with a solid knowledge of operations, strategy and management, Dr. Mike has enjoyed repeated success guiding highly skilled, cross functional teams in areas of intelligence, security, technology, and audit & compliance.

Dr. Mike is an experienced public speaker, writer, and researcher on topics of technology, security, and cybercrime. He stays current with changes in the industry through professional affiliations and continuing professional development. Learn more about Blackswan Cybersecurity at blackswan-cybersecurity.com

Join the live discussions by registering at limacharlie.io/defender-fridays

#237 - Intel Chat: Black Hat roundup - Gemini AI, NeuralTrust & SPLX, VisionSpace Tech, BCM5820X - & CISA/FEMA grant funding

LimaCharlie — Mon, 11 Aug 2025 20:36:28 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

At Black Hat USA in Las Vegas, three security researchers demonstrated how Google's Gemini AI could be hijacked to take control of smart home devices using a novel form of indirect prompt injection.
Two separate security teams - NeuralTrust and SPLX - have conducted red teaming evaluations of the newly released GPT-5, and both report serious deficiencies in the model’s security posture.
Another Black Hat story, security researchers Milenko Starcik and Andrzej Olchawa from VisionSpace Technologies presented a compelling case that hacking satellites is not only more cost-effective than deploying anti-satellite missiles, but alarmingly easy due to widespread software vulnerabilities.
Our final Black Hat story, Cisco Talos researchers disclosed five critical vulnerabilities in Broadcom’s BCM5820X series chips, used in Dell’s ControlVault3 secure enclave hardware.
CISA and FEMA have jointly announced over $100 million in cybersecurity grant funding for the 2025 fiscal year, targeting state, local, and tribal governments.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#236 - Defender Fridays: Explore the Challenges of Securing AI Adoption with Jeremy Snyder, Founder and CEO of FireTail.ai

LimaCharlie — Fri, 08 Aug 2025 20:32:08 +0000

Maxime Lamothe-Brassard, Founder and CEO of LimaCharlie, and Jeremy Snyder, Founder and CEO of FireTail.ai, sat down with the Defender Fridays community to discuss the hurdles of maintaining secure processes while adding AI to your workflow.

Jeremy is the founder and CEO of FireTail.ai. Jeremy was an IT and cybersecurity practitioner for over 10 years before transitioning into product and sales roles in cloud security and cyber. Jeremy once went three days without seeing another human, but saw lots of reindeer. Another time, Jeremy was kicked off a train in central Sweden. Find out more at FireTail.ai.

Join the live discussions by registering at limacharlie.io/defender-fridays.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment.

#237 - Intel Chat: Black Hat roundup - Gemini AI, NeuralTrust & SPLX, VisionSpace Tech, BCM5820X - & CISA/FEMA cyber grant funding

LimaCharlie — Wed, 06 Aug 2025 23:12:03 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

More than 90 state and local government organizations have been targeted in a recent wave of cyberattacks exploiting a vulnerability in Microsoft SharePoint, according to the Center for Internet Security (CIS).
Traditional cyber attack methodologies - exploiting endpoints, moving laterally, escalating privileges - are increasingly outdated as enterprise IT shifts toward SaaS and browser-based access.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-2533 - a high-severity Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF print management software - to its Known Exploited Vulnerabilities (KEV) catalog.
Researchers at Nozomi Networks have disclosed over a dozen security flaws in Tridium’s Niagara Framework, a vendor-agnostic building management platform used in sectors ranging from industrial automation to energy and smart infrastructure.
Between April 2024 and April 2025, ransomware attacks on the oil and gas industry increased by an unprecedented 935%, according to new research from cybersecurity firm Zscaler.

Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.

#234 - Defender Fridays: Autonomous SOC, AI for cybersecurity, and security automation with Filip Stojkovski, Staff Security Engineer at Snyk

LimaCharlie — Sat, 02 Aug 2025 02:19:38 +0000

Join us every Friday as we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

#233 - Intel Chat: SharePoint, ToolShell, UK bans payment & cryptojacking

LimaCharlie — Thu, 31 Jul 2025 20:39:44 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A critical new SharePoint vulnerability is under mass exploitation, with attackers targeting on-premises SharePoint Server deployments to exfiltrate sensitive data, including authentication tokens.
And then directly related to the first story, Microsoft has now confirmed that at least three China-linked threat actors—Linen Typhoon, Violet Typhoon, and Storm-2603—were actively exploiting CVE-2025-49706 and CVE-2025-49704 a day before the company issued patches on July 8.
The UK government announced on July 22, 2025, that it plans to make ransomware payments illegal for public sector bodies and operators of critical national infrastructure (CNI).
In-browser cryptocurrency mining, often called crypto jacking, originally gained notoriety in 2017 when Coinhive introduced JavaScript-based mining for Monero.

#232 - Defender Fridays: AI scarping and internal threat with Lera Leonteva, Founder of Leo AI

LimaCharlie — Fri, 25 Jul 2025 19:11:16 +0000

#231 - Intel Chat: CISCO CVE 10/10, Matanbuchus, Cambodian takedown & Overstep

LimaCharlie — Tue, 22 Jul 2025 18:21:35 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Cisco has disclosed a critical vulnerability—tracked as CVE-2025-20337 with a perfect score of 10—affecting its Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC).
A recently updated version of the malware-as-a-service (MaaS) loader Matanbuchus is being deployed in active spear-phishing campaigns that are ultimately aimed at high-value ransomware infections.
Cambodia has announced the arrest of over 1,000 individuals this week as part of a nationwide crackdown on cybercrime networks operating within its borders.
A threat actor linked to the Abyss ransomware campaign, tracked as UNC6148 by Google’s Threat Intelligence Group (GTIG), appears to be exploiting a zero-day vulnerability in SonicWall’s end-of-life Secure Mobile Access (SMA) 100 series devices.

#230 - Defender Fridays: Cyberphysical protection for high value assets with Lennart Koopman, Founder of

LimaCharlie — Fri, 18 Jul 2025 18:13:22 +0000

#229 - Intel Chat: IntelBroker, Hunters International, Brazilian insider, Ruckus Networks & Patch Tuesday

LimaCharlie — Thu, 17 Jul 2025 21:54:03 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Kai West, a 25-year-old British national, has been indicted by the U.S. Attorney’s Office for the Southern District of New York for allegedly operating under the online alias “IntelBroker.”
Hunters International, a ransomware group that surfaced in 2023 and is believed to have originated from the now-defunct Hive ransomware operation, has announced it is ceasing all activity.
Hackers in Brazil managed to steal nearly $140 million USD from six banks by exploiting insider access at a financial technology firm called C&M, which provides connectivity services to financial institutions and the Brazilian Central Bank.
Several critical vulnerabilities in Ruckus Networks' management products remain unpatched, leaving large-scale WiFi environments at risk of complete compromise.
Microsoft has released security updates addressing 130 vulnerabilities across its product line as part of its July 2025 Patch Tuesday.

#228 - Defender Fridays: Building detection and response processes that scale with Ryan Cox, Senior Security Engineer at Revinate

LimaCharlie — Fri, 11 Jul 2025 18:11:34 +0000

Each week, we bring you a different expert guest who will share their invaluable insights on topics ranging from threat hunting and incident response to security operations and detection engineering. What makes these sessions special is their informal and interactive nature, allowing for an engaging dialogue between our guests, hosts, and the audience.

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#227 - Intel Chat: Sudo, browser vulns, Medusa & Cloudflare blocks AI

LimaCharlie — Tue, 08 Jul 2025 16:20:35 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Two critical local privilege escalation vulnerabilities in the Sudo utility—CVE-2025-32462 and CVE-2025-32463—have been disclosed by the Stratascale Cyber Research Unit.
Google Chrome and Mozilla Firefox are both facing distinct, serious threats this week—Chrome from a zero-day vulnerability under active exploitation and Firefox from a campaign of malicious browser extensions targeting cryptocurrency users.
The Medusa ransomware group, active since late 2021, has maintained a consistent and aggressive operational tempo into 2025.
Cloudflare has rolled out a significant change to how websites handle AI crawlers, positioning itself as the first internet infrastructure provider to block AI-driven scraping by default.

#226 - Intel Chat: Thai takedown, Salt Typhoon, Iran & BlueNoroff

LimaCharlie — Tue, 01 Jul 2025 15:47:44 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Thai police conducted a major raid on the Antai Holiday Hotel in central Pattaya late on Monday night, June 16th, uncovering a joint operation involving both ransomware distribution and illegal gambling.
Canada’s national cybersecurity agency has confirmed that a Chinese state-sponsored group known as Salt Typhoon successfully targeted a Canadian telecommunications company earlier this year, exploiting a Cisco vulnerability.
The Department of Homeland Security (DHS) has issued a National Terrorism Advisory System bulletin warning of an elevated risk of cyberattacks and potentially violent extremism in response to escalating geopolitical tensions between the U.S. and Iran.
Security researchers have confirmed that recent social engineering campaigns exploiting Zoom are the work of BlueNoroff, a North Korean state-sponsored APT group known for targeting financial entities, particularly in the cryptocurrency and online gambling sectors.

#225 - Defender Fridays: EDR, DFIR & endpoint triage with Brian Carrier, CEO of Sleauth Kit Labs

LimaCharlie — Fri, 27 Jun 2025 17:26:45 +0000

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#224 - Intel Chat: OtterCookie, Flodrix, Water Curse & Scattered Spider

LimaCharlie — Tue, 24 Jun 2025 19:27:46 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A new malware strain known as OtterCookie, developed by the North Korean APT group Lazarus, has been dissected in a detailed technical analysis by offensive security expert Mauro Eldritch.
Attackers are currently exploiting a critical vulnerability in the Langflow platform — an open-source Python-based web app used to build AI workflows and agents — to deliver a new botnet called Flodrix.
A new campaign from an emerging threat group named Water Curse is targeting the software supply chain by leveraging GitHub repositories that masquerade as legitimate security tools.
The threat actor known as Scattered Spider, also tracked as UNC3944 by Google and Mandiant, has apparently shifted its operational focus from the retail sector to the US insurance industry, according to a new alert from Google’s Threat Intelligence Group.

#223 - Defender Fridays: Maintaining the human touch in security operations with Hayden Covington, SOC SecOps Lead at BHIS

LimaCharlie — Fri, 20 Jun 2025 16:28:32 +0000

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#222 - Intel Chat: PurpleHaze, KEV++, ChatGPT & Mirai botnet

LimaCharlie — Wed, 18 Jun 2025 17:28:42 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Over an eight-month period beginning in July of last year, China-backed threat actors carried out a coordinated campaign that included attempts to breach cybersecurity vendor SentinelOne.
CISA has added two newly confirmed exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active abuse in the wild.
OpenAI has banned ChatGPT accounts linked to state-sponsored threat actors, including groups affiliated with governments in China, Russia, North Korea, Iran, and others.
A critical vulnerability in Wazuh Server, CVE-2025-24016 (CVSS 9.9), is being actively exploited by threat actors to deliver multiple Mirai botnet variants for distributed denial-of-service (DDoS) operations.

#221 - AI and Automation for security operations with Filip Stojkovski, Staff Security Engineer at Snyk

LimaCharlie — Tue, 17 Jun 2025 14:00:24 +0000

On this episode of the Cybersecurity Defenders Podcast we speak with Filip Stojkovski, Staff Security Engineer at Snyk.

Filip is a cybersecurity professional with over 15 years of experience. He began his career as a SOC analyst and now leads SecOps engineering at Snyk. Filip also advises organizations on SOAR, AI for SOC, and threat intelligence strategies. He holds multiple SANS certifications, including GSTRT, GCTI, and GCFA, and was recognized as “Threat Seeker of the Year.” He is the creator of the LEAD Threat Intelligence Framework and the Security Automation Development Life Cycle.

Filip regularly shares his expertise through industry talks and on his blog: Cyber Security Automation and Orchestration

#220 - Defender Fridays: AI on the edge with David (DWIZZLE) Weston, Corporate Vice President, Enterprise and OS Security at Microsoft

LimaCharlie — Fri, 13 Jun 2025 17:25:21 +0000

You can sign up to join us for the live sessions at limacharlie.io/defender-fridays

#219 - Intel Chat: MSFT-Crowdstrike, GangExposed, Fastlane & HashiCorp Nomad servers

LimaCharlie — Wed, 11 Jun 2025 13:00:17 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Microsoft and CrowdStrike have announced a strategic alliance aimed at deconflicting threat actor names across their platforms.
A new, anonymous figure calling himself GangExposed has surfaced in the cyber threat landscape, publishing a significant set of internal documents that reveal the identities of top leadership within the Conti and Trickbot ransomware crews.
A new supply chain attack targeting the Ruby ecosystem has emerged, leveraging impersonated packages to exfiltrate sensitive data from Telegram communications.
Researchers at Wiz have published what appears to be the first confirmed case of active exploitation of misconfigured HashiCorp Nomad servers in the wild, used by attackers to mine Monero cryptocurrency.

#218 - Coinbase + Cetus, Hazy Hawk, BadSuccesssor & DCIS takedown

LimaCharlie — Tue, 03 Jun 2025 16:56:11 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Two significant crypto security breaches occurred in close succession this month, affecting both decentralized and centralized platforms. On May 22, Cetus—a decentralized exchange built on the Sui Network—was exploited via a vulnerability in its automated market maker (AMM). Meanwhile, Coinbase confirmed what it called a “targeted insider threat operation” that compromised data from less than 1% of its active monthly users.
A threat group identified as “Hazy Hawk” has been systematically hijacking cloud-based DNS resources tied to well-known organizations, including the US Centers for Disease Control and Prevention (CDC), since December 2023.
A newly disclosed vulnerability in Windows Server 2025, dubbed BadSuccessor, has raised major concerns among enterprise administrators managing Active Directory environments.
Federal and international law enforcement, alongside a significant number of private-sector partners, have successfully dismantled the Danabot botnet in a multiyear operation aimed at neutralizing one of the more advanced malware-as-a-service (MaaS) platforms tied to Russian cybercriminal activity.

#217 - Navigating compliance and risk with Joshua Hoffman, CRO at ControlCase

LimaCharlie — Tue, 27 May 2025 15:04:50 +0000

On this episode of the Cybersecurity Defenders Podcast we speak with Joshua Hoffman, CRO at ControlCase.

Josh brings a unique perspective to the cybersecurity conversation, shaped by years of building revenue strategies in fast-changing, highly regulated environments. At ControlCase, he's helping organizations navigate the growing complexity of compliance standards like CMMC, SOC, and PCI DSS, while driving adoption of tech-forward approaches to risk management. His background spans advisory roles and leadership positions across the cybersecurity ecosystem, making him a key voice on how businesses can move beyond checkbox compliance to a more strategic, scalable security posture.

#216 - Intel Chat: Scattered Spider, TA406, Oriental Gudgeon & Apple patches

LimaCharlie — Wed, 21 May 2025 13:17:14 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

A report from Google on how to defend against UNC3944, better known as Scattered Spider.
North Korea-backed threat actor TA406 has shifted its focus to targeting Ukrainian government agencies, according to new research from Proofpoint.
Since October 2024, urlscan.io has been tracking a phishing campaign known as Oriental Gudgeon, which is targeting over 40 Japanese commercial entities—mostly in the financial services sector.
Apple has released a substantial batch of security updates across its software ecosystem, including iOS 18.5, iPadOS, and the latest versions of macOS.

And the article Matt mentions about CISA shifting their alert distribution strategy: https://www.infosecurity-magazine.com/news/cisa-alert-strategy-email-social/

#215 - Inside cyber warfare, intelligence, and investment with Hank Thomas, Managing Partner and Founder at Strategic Cyber Ventures

LimaCharlie — Thu, 15 May 2025 17:47:16 +0000

On episode 215 of the Cybersecurity Defenders Podcast, Hank Thomas, Managing Partner and Founder at Strategic Cyber Ventures, shares his journey from Army intelligence officer to cyber-focused venture capitalist. But the most pressing part of the conversation is his call for a structural overhaul in how the US military handles cyber operations.

Thomas argues that cyber is no longer a niche; it is the starting point for modern conflict. Yet cyber capability remains fragmented across service branches, leading to inefficiencies, talent drain, and even internal competition for resources. He makes the case for a separate, fully resourced cyber force, similar to the creation of the Air Force and Space Force, to truly secure the digital domain.

He also shares concerns about government overreliance on contractors in critical cyber roles, the need for agile decision-making authority during cyber operations, and why AI must be deployed responsibly to defend a fractured critical infrastructure landscape.

#214 - Intel Chat: UTA0352/UTA0355, Commvault, Sonic wall & Bot Traffic

LimaCharlie — Wed, 14 May 2025 17:49:44 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Since March 2025, Volexity has tracked an escalation in sophisticated phishing campaigns executed by two suspected Russian threat actors, UTA0352 and UTA0355, targeting the Microsoft 365 accounts of individuals connected to Ukraine and human rights organizations.
A recent security assessment by watchTowr uncovered a pre-authenticated Remote Code Execution (RCE) vulnerability in Commvault’s on-premise Backup and Recovery solution (Innovation Release 11.38.20).
CISA has added two SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating an escalation in exploitation activity against the vendor’s SMA series of secure remote access appliances.
Bot traffic has overtaken legitimate human use on the internet, with the latest data showing that automated traffic now accounts for 51% of all internet activity—of which 37% is classified as malicious.

#213 - Building cybersecurity products with Jonathan Haas, Product at Vanta

LimaCharlie — Thu, 08 May 2025 16:47:00 +0000

On this episode of the Cybersecurity Defenders Podcast we speak with Jonathan Haas, Product at Vanta, about building cybersecurity products.

Jonathan’s work focuses on making security compliance faster and more accessible, helping teams move from months-long processes to efficient workflows that take just days. Before Vanta, he was the co-founder and CEO of cybersecurity startup ThreatKey, and before that he held key roles at Snapchat, DoorDash, and Carta, where he built and refined compliance systems during times of rapid growth.

Outside of work, Jonathan explores San Francisco on foot, experiments with sourdough pizza recipes, and is cooking a dish from every country in the world. He brings a product philosophy rooted in solving real problems, blending data with user stories, and fostering inclusive teams.

You can read his blog, Haas on Saas, here.

#212 - Intel Chat: RSA 2025

LimaCharlie — Mon, 05 May 2025 15:31:14 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

During a talk at RSA, DHS Secretary Kristi Noem provided an update on the future direction of the Cybersecurity and Infrastructure Security Agency (CISA) under the new Trump administration.
During the panel discussion titled “AI and Cyber Defense: Protecting Critical Infrastructure” which brought together federal research leaders to talk about how AI and automation are being leveraged to address mounting cyber risks across the U.S. critical infrastructure landscape.
A new report titled The Rise of State-Sponsored Hacktivism provides a detailed analysis of how hacktivist operations have become an increasingly prominent feature of geopolitical cyber conflict.

#211 - Intel Chat: Fog, Operation Endgame, Mustang Panda & Atomic macOS Stealer (AMOS)

LimaCharlie — Tue, 29 Apr 2025 13:09:46 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.

Researchers at Trend Micro have uncovered a new campaign by the Fog ransomware group, notable for its use of DOGE-themed ransom notes aimed at mocking victims rather than just extorting them.
In the wake of May 2024’s Operation Endgame, which dismantled some of the most prominent malware droppers such as IcedID, Pikabot, SystemBC, Smokeloader, and Bumblebee, law enforcement agencies across Europe and North America have moved into a new phase targeting end users of these platforms.
Zscaler researchers have recently observed Mustang Panda—also known by aliases like Bronze President, Stately Taurus, and TA416—upgrading its toolset as part of an ongoing espionage campaign, with a recent operation targeting an organization in Myanmar.
Atomic macOS Stealer (AMOS), identified as one of the most impactful macOS-targeting infostealers of 2024, leverages deceptive application installers and phishing tactics to gain access to victim machines.

#210 - The current cybersecurity landscape with Ian L. Paterson, CEO of Plurilock

LimaCharlie — Fri, 25 Apr 2025 19:26:49 +0000

On today’s episode of The Cybersecurity Defenders Podcast we speak with Ian L. Paterson, CEO of Plurilock, about the current state of Cybersecurity.

Ian is a data entrepreneur with more than 15 years of experience in leading and commercializing technology companies in the fields of data analytics and cybersecurity. Ian is the CEO of Plurilock, where he led the company’s growth and its successful listing on the TSX Venture Exchange.

He previously founded and served as CEO of a data monetization platform that processed over a billion data events monthly before being acquired. Ian also held the role of Director of Insights at a venture backed analytics firm, where he managed half a trillion dollars in transaction data and helped generate eight-figure analytics sales before the company’s acquisition by eBay.

Ian has raised tens of millions of dollars in financing, completed four international M&A deals, and is a co-inventor on three patents. He is an active angel investor, a frequent media commentator featured in publications like Forbes and the Wall Street Journal, and a volunteer contributor to national policy through organizations such as the Canadian Council of Innovators and the Centre for International Government Innovation.

You can listen to Ian's podcast, Code & COuntry, here: https://plurilock.com/podcast/

#209 - Intel Chat: OCC, CentreStack, UNC5174 & Oracle

LimaCharlie — Mon, 21 Apr 2025 16:08:54 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community.

The U.S. Treasury Department’s Office of the Comptroller of the Currency (OCC) has confirmed that emails belonging to its executives and staff were compromised in a cyber incident first detected in February.
A critical zero-day vulnerability, tracked as CVE-2025-30406, has been actively exploited since March in CentreStack, a file-sharing platform developed by Gladinet and widely used by managed services providers (MSPs).
UNC5174, a state-backed Chinese threat actor, has been observed using stealthy tactics and open source tooling in recent campaigns targeting Western and Asia-Pacific organizations.
Oracle is facing sustained criticism over its handling of a recent cybersecurity incident in which a hacker claimed to have breached its systems and obtained records linked to over 140,000 tenants.

#208 - Cybersecurity in space with Blake Hershey and Gabe Garrett from MORI Associates

LimaCharlie — Tue, 15 Apr 2025 14:54:53 +0000

On today’s episode of The Cybersecurity Defenders Podcast we are going to be speaking with a couple of team members from MORI Associates, a leading firm with over 25 years of experience in delivering comprehensive solutions across technology, communication, and space mission support.

Specializing in scalable, high-impact technologies, the company addresses current challenges while anticipating future needs, contributing to a more connected, efficient, and secure future.

MORI Associates has played pivotal roles in supporting missions to Earth orbit, the moon, and beyond, contributing to groundbreaking projects that advance both terrestrial applications and interstellar explorations.

Our first guest is Gabe Garrett, Senior Vice President of Space and Defense at MORI Associates. With nearly two decades of experience in the aerospace and defense industries, Gabe leads strategy, growth, and operations across key civil and defense accounts. Before joining MORI Associates, he served as Account Vice President at SAIC, overseeing the Human Space Exploration and Operations Solutions division. Gabe's extensive background includes leadership roles at Engility Corporation and engineering experience with spacecraft, launch vehicles, and mission systems at ARES Corporation.

Our other guest is Blake Hershey, Chief Growth Officer at MORI Associates. Blake is a visionary entrepreneur known for his passion for creating products that enhance lives and drive positive behavioral changes.

With a track record of transforming concepts into successful multi-million-dollar ventures, he brings extensive expertise in business development, including finance, operations, marketing, product innovation, and strategic planning.

His leadership has been instrumental in driving significant revenue growth at MORI Associates over the past several years. Blake has also been recognized by Forbes' Next 1000 for his entrepreneurial achievements.

#207 - Intel Chat: MirrorFace, Neptune, Sparrow door & CrushFTP

LimaCharlie — Fri, 11 Apr 2025 16:14:51 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community.

Japanese law enforcement has publicly linked a Chinese state-sponsored threat group known as MirrorFace to a series of cyberattacks that have targeted Japan over the past five years.
Researchers at Cyfirma have detailed a new campaign where attackers are using a Remote Access Trojan (RAT) dubbed Neptune to hijack Windows systems.
Researchers have discovered new variants of a previously identified Linux backdoor known as SparrowDoor, believed to be the work of a North Korean state-sponsored group known as Kimsuky.
CISA has added a recently disclosed vulnerability in CrushFTP (tracked as CVE-2024-4040) to its Known Exploited Vulnerabilities (KEV) catalog.

#206 - The AI Threat Landscape Report with Eoin Wickens, Director of Threat Intelligence at HiddenLayer

LimaCharlie — Mon, 07 Apr 2025 15:48:09 +0000

On this episode of the Cybersecurity Defenders Podcast we dive into the AI Threat Landscape report with Eoin Wickens, Director of Threat Intelligence at HiddenLayer.

Eoin specializes in AI security, threat research, and malware reverse engineering. Eoin has authored numerous articles on AI security, co-authored a book on cyber threat intelligence focusing on Cobalt Strike, and has spoken at conferences such as DEF CON AI Village, BSides San Francisco, LABScon, and 44CON. He also delivered the 2024 SCORED opening keynote.

You can get a copy of the report here: https://hiddenlayer.com/threatreport2025/

#205 - Intel Chat: OPSEC FAIL, Manifest Confusion & Github Actions

LimaCharlie — Tue, 01 Apr 2025 14:48:32 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community.

On March 24, The Atlantic’s editor-in-chief Jeffrey Goldberg reported a significant OPSEC failure involving U.S. Secretary of Defense Pete Hegseth, who allegedly sent him detailed U.S. military plans over Signal—an encrypted messaging app—on March 15.
A newly discovered supply chain attack on the npm ecosystem is targeting developers by backdooring local packages through a process known as “manifest confusion.”
Unit 42 researchers at Palo Alto Networks have uncovered an ongoing software supply chain attack targeting GitHub repositories via malicious GitHub Actions workflows.

#204 - Intel Chat: Wiz, Windows, SocGholish, WDAC & BLE

LimaCharlie — Fri, 21 Mar 2025 17:31:04 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Google has announced a $32 billion ALL CASH acquisition of the Israeli cybersecurity startup Wiz, making it one of the largest deals in the company’s history.
A newly discovered zero-day vulnerability in Windows allows attackers to escalate privileges, potentially granting them full control over affected systems.
Security researchers have identified new intrusion techniques used by the SocGholish malware framework, which is increasingly being leveraged to distribute ransomware.
Security researchers have uncovered a new technique that allows attackers to disable Endpoint Detection and Response (EDR) solutions using Windows Defender Application Control (WDAC).
Security researchers have discovered undocumented commands in a widely used Bluetooth chip, potentially exposing over a billion devices to security risks.

#203 - Breaking the stigma of addiction in cyber with Jen VanAntwerp, Founder of Sober in Cyber

LimaCharlie — Thu, 20 Mar 2025 03:03:20 -0100

On today's episode of the Cybersecurity Defenders Podcast, we speak with Jen VanAntwerp, the Founder of Sober in Cyber.

Jen is a cybersecurity marketing professional and the founder of Sober in Cyber, a nonprofit on a mission to provide alcohol-free events and community-building opportunities for sober and sober-curious individuals working in infosec. Jen is passionate about breaking the stigma of addiction recovery and is profoundly driven to increase the number of professional networking events that don’t revolve around alcohol. She is also the founder of JVAN Consulting, where she provides marketing consultation services to cybersecurity startups.

Sober in Cyber Discord can be found here.

#202 - Intel Chat: CISA, BianLian (not), Crafty Camel, Github malvertising & SCADA

LimaCharlie — Fri, 14 Mar 2025 15:14:34 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of the LimaCharlie community.

The Cybersecurity and Infrastructure Security Agency (CISA) is facing significant operational challenges as budget constraints force it to scale back key cybersecurity programs.
Scammers are taking a new approach to extortion by mailing physical ransom letters to victims, claiming to be the operators of the BianLian ransomware group.
A newly identified advanced persistent threat (APT) group, dubbed "Crafty Camel," has been targeting aviation operational technology (OT) systems using a sophisticated technique involving polyglot files.
A new malvertising campaign is leveraging deceptive online ads to distribute information-stealing malware hosted on GitHub, highlighting an ongoing evolution in cybercriminal tactics.
Security researchers have disclosed details of multiple vulnerabilities in Supervisory Control and Data Acquisition (SCADA) systems that could be exploited to facilitate attacks on industrial environments.

#201 - Scaling Managed Security Operations with Andrew Cook, CTO of Recon InfoSec

LimaCharlie — Wed, 12 Mar 2025 16:41:17 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Andrew Cook, CTO of Recon InfoSec, about lessons learned scaling Managed Security Operations.

#200 - Multimodal Offensive Artificial Intelligence with Philippe Humeau, CEO of CrowdSec

LimaCharlie — Tue, 11 Mar 2025 16:40:05 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Philippe Humeau, CEO of CrowdSec, about Multimodal Offensive Artificial Intelligence (MOAI).

Philippe is a cybersecurity expert and seasoned entrepreneur with a deep passion for enhancing global internet security. He is the founder and CEO of CrowdSec, an innovative open-source platform that harnesses the power of community-driven threat intelligence to protect systems worldwide. Philippe's work focuses on collaborative approaches to cybersecurity, ensuring that organizations can stay ahead of evolving threats by pooling collective knowledge and resources. With years of experience building solutions that address complex security challenges, Philippe has made a significant impact on the field.

Before founding CrowdSec, Philippe successfully launched and led several companies within the cybersecurity space, further cementing his reputation as a thought leader and innovator. His journey reflects a commitment to addressing the most pressing challenges in the digital age, from fostering safer internet ecosystems to empowering businesses with the tools they need to defend against cyberattacks. Philippe is also an advocate for open-source technology and community-driven solutions, underscoring his belief that collaboration is key to combating global threats.

#199 - Intel Chat: Lazarus Group, BadPilot, PAN-OS, emoji exfil, Kitty Stealer & PolarEdge

LimaCharlie — Fri, 07 Mar 2025 17:25:51 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

North Korea’s state-backed Lazarus Group is believed to be responsible for the largest cryptocurrency heist ever recorded, stealing $1.5 billion from the Bybit exchange.
The "BadPilot" hacking campaign has been linked to Russia's Sandworm threat group, a unit of the GRU known for cyber espionage and disruptive attacks.
GreyNoise has observed active exploitation of CVE-2025-0108, a critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS.
Security researcher Paul Butler has demonstrated a novel technique for smuggling arbitrary data using emojis, leveraging the way modern text encoding and rendering systems handle Unicode characters.
Kitty Stealer is a newly identified malware targeting macOS systems, designed to steal sensitive user data such as credentials, browser cookies, and cryptocurrency wallets.
SEKOIA researchers have uncovered a previously unknown IoT botnet named PolarEdge, which has been operating covertly for an extended period.

#198 - AI risk and safety with John Vaina, AI Researcher & Red Teamer

LimaCharlie — Thu, 06 Mar 2025 20:59:57 -0100

On this episode of The Cybersecurity Defenders Podcast we talk with John Vaina, AI Researcher and Red Teamer, about AI risk and safety.

John is an expert in AI risk, safety, and security. John currently works as an AI red team operator, tackling some of the most complex challenges in the field. His work spans traditional cybersecurity concerns, such as identifying vulnerabilities in AI systems, to cutting-edge tasks like testing for emergent behaviors and conducting AI alignment and safety audits.

John’s expertise includes evaluating ethical and bias risks, ensuring model robustness, and running adversarial attack simulations to uncover potential weaknesses. Beyond these technical aspects, he also addresses broader safety issues, including scenarios involving CBRNE threats and other high-stakes risks.

John’s unique combination of technical skills, strategic thinking, and a focus on ethical considerations makes him a leading voice in ensuring that AI technologies are safe, secure, and aligned with human values.

#197 - Avoiding burnout and a managing stress with Amanda Berlin, CEO of Mental Health Hackers

LimaCharlie — Fri, 28 Feb 2025 16:38:43 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss stress management and avoiding burnout with Amanda Berlin, CEO of Mental Health Hackers.

Amanda is the Senior Product Manager of Cybersecurity at Blumira, where she collaborates with a talented team to make security more accessible. With a career in IT spanning nearly her entire adult life, her expertise includes infrastructure security, network troubleshooting, purple teaming, and security awareness training.

Beyond her role at Blumira, Amanda leads Mental Health Hackers, an organization dedicated to addressing the unique mental health challenges faced by cybersecurity professionals and heavy technology users. Through education and advocacy, she helps shine a light on the critical intersection of mental health and the tech industry.

All of the links:

Coffee bot: Donuts

Book: The Fearless Organization

American Psychological Association

Mental Health hackers next at: Bsides Charm in Baltimore, Blue Team Con in Chicago... check social media for more

#196 - Security challenges in the Arctic with Deepak Dutt, Founder of Zighra

LimaCharlie — Tue, 25 Feb 2025 16:40:13 -0100

On this episode of The Cybersecurity Defenders Podcast, we talk about security issues in the Arctic with Deepak Dutt, Founder of Zighra.

Deepak is a technology leader and entrepreneur on a mission to secure the future against AI-powered threats and to inspire founders to transform their ideas from zero to meaningful impact.

Deepak’s career began in the software space, inspired by his father’s passion for technology. In his late teens, he founded his first company in the eLearning space, which he successfully led to an acquisition, relocating to Ottawa at the age of 21.

While in Ottawa, Deepak balanced graduate studies with roles at Newbridge Networks and Nortel, where he spent nearly a decade gaining expertise in product development, go-to-market strategy, and technological innovation. These experiences reinforced his drive to harness technology’s transformative potential.

In 2009, Deepak founded his second startup, a cloud-based cybersecurity company. Over the years, he has participated in leading accelerators worldwide, including Barclays/Techstars, Creative Destruction Labs, and the Canadian Technology Accelerator. Today, as Founder and CEO of Zighra, he is building an operating system designed to defend against AI-powered attacks, working with financial institutions and governments to deliver robust security solutions powered by explainable AI, behavioral biometrics, and contextual intelligence.

A passionate advocate of the Zero to Impact philosophy, Deepak is committed to inspiring tech founders to embrace big challenges and develop innovations that drive meaningful change.

#195 - Intel Chat: APT tunnelling, BadPilot, CVE-2025-0108, emojis & Kitty Stealer (take 2)

LimaCharlie — Fri, 21 Feb 2025 15:17:23 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Network traffic tunneling is a technique used by attackers to bypass security controls and exfiltrate data or establish covert communication channels. Threat actors use various tunneling methods, including DNS tunneling, HTTP/S tunneling, and ICMP tunneling, each with its own advantages depending on the target environment.

The "BadPilot" hacking campaign has been linked to Russia's Sandworm threat group, a unit of the GRU known for cyber espionage and disruptive attacks.

GreyNoise has observed active exploitation of CVE-2025-0108, a critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS. This vulnerability allows unauthenticated attackers to gain administrative access to affected firewall devices, posing a significant risk to organizations relying on PAN-OS for network security.

Security researcher Paul Butler has demonstrated a novel technique for smuggling arbitrary data using emojis, leveraging the way modern text encoding and rendering systems handle Unicode characters.

Kitty Stealer is a newly identified malware targeting macOS systems, designed to steal sensitive user data such as credentials, browser cookies, and cryptocurrency wallets.

#194 – Exploring MSSP partnerships and technology providers with Raffaele Mautone, CEO of Judy Security

LimaCharlie — Wed, 19 Feb 2025 13:00:17 -0100

On this episode of The Cybersecurity Defenders Podcast, we explore MSSP partnerships and technology providers with Raffaele Mautone, CEO of Judy Security.

Raffaele brings a strong background in IT, sales, and operations, with extensive experience in cybersecurity and IT shaping the foundation of Judy Security. He has a proven track record of leading teams through successful acquisitions, strategic planning, and large-scale program deployments.

Throughout his career, he has worked with major companies like Duo, FireEye, McAfee, and Dell, focusing on marketing and sales strategies, business process improvements, and go-to-market programs.

Judy Security delivers enterprise-grade cybersecurity tailored for SMBs and MSPs. Their AI-powered platform is affordable, intuitive, and designed to seamlessly integrate with MSP business models while addressing the unique security challenges of SMBs. With Judy Security, businesses can stay protected with advanced, easy-to-use cybersecurity solutions—because safeguarding data shouldn’t be complicated.

#193 - Intel Chat: Ransomware drops, 8Base, XE Group, SolarWinds-esque attack & cyber-espionage in South Asia

LimaCharlie — Thu, 13 Feb 2025 18:39:36 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Ransomware payments saw a significant drop in 2024, falling by 35% compared to the previous year.
Law enforcement agencies have arrested a suspected core member of the 8Base ransomware group, marking a significant development in efforts to combat cybercrime.
The XE Group, a financially motivated cybercrime organization, has shifted its tactics from traditional card-skimming attacks to more sophisticated supply chain compromises.
Security researchers at watchTowr have demonstrated a supply chain attack technique that surpasses the scale and stealth of the infamous SolarWinds breach.
A newly discovered cyber-espionage campaign is targeting government and military entities in South Asia, according to researchers at Unit 42.

#192 - Talent acquisition, training, and retention in the MSSP space with Paul Ihme, Cofounder & Managing Principle at Soteria

LimaCharlie — Tue, 11 Feb 2025 14:41:49 -0100

On this episode of The Cybersecurity Defenders Podcast we talk about talent acquisition, training, and retention in the MSSP space with Paul Ihme, Cofounder & Managing Principle at Soteria.

Paul is a cybersecurity professional with extensive experience in both federal and private sectors. He is the co-founder and managing principal of Soteria, a firm that provides tailored cybersecurity solutions and strategic advisory services to help businesses defend against cyber threats 24/7. Soteria specializes in managed detection and response, domain monitoring, and risk management for Microsoft 365 environments among other things. Prior to founding Soteria, Paul held key roles in cybersecurity, including Vice President of Active Network Defense at JPMorgan Chase and as a Cyber Warfare Operator in the U.S. Air Force. Today, we are going to be discussing what it takes to Build a Skilled Team and exploring his experience with Talent acquisition, training, and retention in the MSSP space.

#191 - Intel Chat: Lumma Stealer, xWorm, WSDOT & FortiOS

LimaCharlie — Tue, 04 Feb 2025 19:25:51 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Lumma Stealer, an information-stealing malware, has been observed using new evasion techniques to avoid detection.
Researchers at CloudSEK have uncovered a trojanized version of the xWorm Remote Access Trojan (RAT) builder that is being secretly distributed among cybercriminals.
A recent disclosure by security researcher Zach Latta highlights how the Washington State Department of Transportation (WSDOT) inadvertently exposed sensitive server credentials on its public website.
A critical authentication bypass vulnerability (CVE-2024-21762) in Fortinet’s FortiOS has been actively exploited in the wild, allowing attackers to execute arbitrary code or gain unauthorized access to affected systems.

#190 - How MSSPs can help clients meet regulatory requirements with Garret Grajek, CEO at YouAttest

LimaCharlie — Mon, 03 Feb 2025 18:04:03 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Garret Grajek, CEO of YouAttest, about how MSSPs help clients meet regulatory requirements and what it means for the MSSP.

Garret is a certified security leader with nearly 30 years of experience in information security. Garret is widely recognized as a visionary in identity, access, and authentication, holding 13 patents in areas such as x.509, mobile security, single sign-on (SSO), federation, and multi-factor technologies. Over the course of his career, he has contributed to major security projects for prominent commercial clients like Dish Networks, Office Depot, TicketMaster, and E*Trade, as well as public sector organizations including the U.S. Navy and the EPA.

Garret began his career as a security programmer at Texas Instruments, IBM, and Tandem Computers, later advancing to key roles at RSA, Netegrity, and Cisco. He is also the founder and creator of SecureAuth IdP, a two-factor authentication and SSO platform. Known for his expertise in security architecture, product development, and leadership, Garret is a thought leader in modern IT architecture, including mobile deployments, cloud, hybrid environments, and advanced authentication technologies.

#189 - Intel Chat: Docker, LDAPNightmare, Codefinger & Fortinet FortiGate

LimaCharlie — Tue, 28 Jan 2025 15:09:42 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

From earlier this week, The Docker Systems Status page reports an ongoing issue affecting Docker Desktop on macOS, where malware alerts are triggered by macOS identifying com.docker.vmnetd or com.docker.socket as potential threats.
SafeBreach Labs has released a proof-of-concept (PoC) exploit for CVE-2024-49113, a critical vulnerability in the Lightweight Directory Access Protocol (LDAP) that impacts unpatched Windows Servers, including Active Directory Domain Controllers (DCs).
The Halcyon RISE team has uncovered a novel ransomware campaign targeting Amazon S3 buckets, exploiting AWS’s Server-Side Encryption with Customer-Provided Keys (SSE-C).
A recent campaign has been targeting Fortinet FortiGate firewalls with exposed management interfaces, likely exploiting a zero-day vulnerability to gain unauthorized administrative access.
Sophos recently reported on two distinct ransomware campaigns utilizing unique techniques to pressure victims and evade detection.

#188 - The MSSP Alert 2024 Pricing Benchmark Report with Sharon Florentine, Senior Managing Editor at CyberRisk Alliance

LimaCharlie — Thu, 23 Jan 2025 14:25:32 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Sharon Florentine, Senior Managing Editor at CyberRisk Alliance, about the MSSP Alert 2024 Pricing Benchmark Report.

Sharon is a master technology storyteller and editor with over two decades of experience in shaping the way we understand and engage with technology. Sharon's career spans an impressive range of platforms, from books and print magazines to podcasts, live events, and digital media. She's covered everything from AI and cybersecurity to career development and diversity in tech.

Currently, Sharon is the Senior Managing Editor for CyberRisk Alliance's channel brands, ChannelE2E and MSSP Alert, where she’s helping to expand the reach of these vital resources for the IT and cybersecurity communities. Sharon has a rich history of editorial leadership, including her previous role as Managing Editor at Techstrong Group, overseeing Cloud Native Now, DevOps.com, and Security Boulevard.

She joins us to discuss the inaugural 2024 MSSP Pricing Benchmark Report—a critical resource for understanding the evolving managed security services market.

You can get a copy of the report here: https://www.msspalert.com/whitepaper/mssp-alert-2024-pricing-benchmark

#187 - Automation in MSSP Operations with David Burkett, Cloud Security Researcher at Corelight

LimaCharlie — Tue, 14 Jan 2025 16:56:36 -0100

On this episode of The Cybersecurity Defenders Podcast we talk about automation in MSSP operations with David Burkett, Cloud Security Researcher at Core light.

David has deep expertise in cloud threat detection and automation. Over the course of his career, David has built and optimized three different Cyber Security Operations Centers for MSSP and MDR providers, demonstrating his unparalleled skill in scaling security operations through automation and efficient processes.

David has consulted for over 40 Fortune 500 companies and large federal organizations, helping them design and implement SOAR platforms and playbooks that enhance detection and response capabilities. He also actively contributes to the open-source detection project Sigma, showcasing his dedication to advancing the cybersecurity community.

Among his many accolades, David was part of a team that received the prestigious James S. Cogswell Outstanding Industrial Security Achievement Award, recognizing their SOC as one of the top 1% in cybersecurity programs for cleared facilities. He also holds a robust set of GIAC certifications, reinforcing his technical expertise in threat intelligence, cloud security, and playbook design.

#186 - Intel Chat: Amit Yoran, USDoD, BeyondTrust & LDAPNightmare

LimaCharlie — Wed, 08 Jan 2025 06:49:09 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

We pause to honor the life and legacy of Amit Yoran, a visionary leader in the world of cybersecurity who passed away on January 4, 2025, after battling cancer.
In April 2024, a threat actor known as "USDoD" advertised a massive database for sale on BreachForums, claiming it contained 2.9 billion records encompassing personal information of individuals from the United States, United Kingdom, and Canada.
In December 2024, the U.S. Treasury Department disclosed a significant cybersecurity breach attributed to Chinese state-sponsored hackers.
SafeBreach Labs has published a proof-of-concept (PoC) exploit for CVE-2024-49113, dubbed "LDAPNightmare." This vulnerability affects Windows Servers using the Lightweight Directory Access Protocol (LDAP) and enables attackers to crash unpatched systems.

#185 - Bootstrapping an MSSP with Nick Gipson, Founder & CEO at Gipson Cyber

LimaCharlie — Tue, 07 Jan 2025 07:11:38 -0100

MSSPs and other security service providers comprise the backbone of the cybersecurity industry. They are the organizations on the front line that keep the world running in the face of ever more sophisticated adversaries.

In this special series we are going to be exploring a variety of topics with seasoned experts around the ways they have learned to improve the effectiveness of their organizations.

Our guest today is Nick Gipson - the founder and CEO of Gipson Cyber.

Nick founded Gipson Cyber in February 2023 to provide affordable, subscription-based cybersecurity services to small businesses. With nearly a decade of experience as a digital forensics investigator for the Department of Defense and Fortune 100 companies, Nick recognized a gap in cybersecurity solutions for smaller organizations. Determined to address this, he built Gipson Cyber to deliver proffesional-grade protection to industries like accounting, finance, legal, and healthcare.

Nick’s company focuses on equipping small businesses with the tools to prevent cyber threats before they happen, backed by a team with over 20 years of expertise in the field. Today, we’ll explore not only the challenges small businesses face in cybersecurity but also the lessons Nick has learned in building a managed security service provider from the ground up.

Nick Gipson, the founder of Gipson Cyber, a company he launched in February 2023 to provide affordable, subscription-based cybersecurity services to small businesses. With nearly a decade of experience as a digital forensics investigator for the Department of Defense and Fortune 100 companies, Nick recognized a gap in cybersecurity solutions for smaller organizations. Determined to address this, he built Gipson Cyber to deliver proffesional-grade protection to industries like accounting, finance, legal, and healthcare.

#184 - Hacker Holidays: The Colonial Pipeline

LimaCharlie — Wed, 01 Jan 2025 19:48:33 -0100

In this episode of The Cybersecurity Defenders Podcast, we recount some hacker history, and with the help of Casey Ellis, Founder and CSO at Bugcrowd, tell the story of the largest critical infrastructure ransomware attacks in history: The Colonial Pipeline

On May 7, 2021, Colonial Pipeline, an American oil pipeline system that originates in Houston, Texas, and carries gasoline and jet fuel mainly to the Southeastern United States, suffered a ransomware cyberattack that impacted computerized equipment managing the pipeline. The Colonial Pipeline Company halted all pipeline operations to contain the attack. Overseen by the FBI, the company paid the amount that was asked by the hacker group (75 bitcoin or $4.4 million USD) within several hours; upon receipt of the ransom, an IT tool was provided to the Colonial Pipeline Company by DarkSide to restore the system. However, the tool required a very long processing time to restore the system to a working state.

This episode was written by the talented Nathaniel Nelson.

Casey Ellis can be found on LinkedIn here.

#183 - Hacker Holidays: When the lights went out in Ukraine (Part 1 & 2)

LimaCharlie — Tue, 31 Dec 2024 16:27:09 -0100

On this episode of The Cybersecurity Defenders Podcast, we share both parts of 'When the Lights Went Out in Ukraine.'

Beginning on January 13th, 2022, a Russian APT installed wiper malware on the IT networks of government, NGO, and IT companies across Ukraine. The malicious program was designed to appear like ransomware, but contained no recovery feature – it simply destroyed any computer it wished. Just one day later, hackers from the intelligence service of Belarus – Russia’s close ally – took down 70 websites belonging to the Ukrainian government. This was tilling – laying down the foundation for an all-out ground attack. Plastered on the 70 downed websites was a message from the attackers: “be afraid,” they wrote, and expect the worst.”

This episode was written by the talented Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

And a special thank you to Robert Lipovsky for sharing his first-hand knowledge.

#182 - Hacker Holidays: Stuxnet (Part 1 & 2)

LimaCharlie — Mon, 30 Dec 2024 18:20:28 -0100

This episode of the Cybersecurity Defenders podcast is a two-part mini-series about the greatest cyber attack ever conceived: Stuxnet. Joining to help us tell the story is Kim Zetter, Journalist and Author - Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon. Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005. Stuxnet targets supervisory control and data acquisition (SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, the worm is widely understood to be a cyberweapon built jointly by the United States and Israel in a collaborative effort known as Operation Olympic Games. The program, started during the Bush administration, was rapidly expanded within the first months of Barack Obama's presidency. This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

#181 - Hacker Holidays: WannaCry

LimaCharlie — Sun, 29 Dec 2024 09:20:59 -0100

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history, and with the help of Marcus Hutchins, tell the story of the WannaCry ransomware attack. The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It propagated by using EternalBlue, an exploit developed by the United States National Security Agency (NSA) for Windows systems. EternalBlue was stolen and leaked by a group called The Shadow Brokers a month prior to the attack. Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere.

#180 - Hacker Holidays: Titan Rain

LimaCharlie — Sat, 28 Dec 2024 06:28:29 -0100

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history and tell the story of Shawn Carpenter; a rogue cybersecurity defender who singlehandedly identified a Chinese APT. It is a phenomenal story that exemplifies the grit and moral fortitude that the best defenders among us have. Titan Rain was a series of coordinated attacks on computer systems in the United States since 2003; they were known to have been ongoing for at least three years. The attacks originated in Guangdong, China. The activity is believed to be associated with a state-sponsored advanced persistent threat. It was given the designation Titan Rain by the federal government of the United States.

Titan Rain hackers gained access to many United States defense contractor computer networks, which were targeted for their sensitive information, including those at Lockheed Martin, Sandia National Laboratories, Redstone Arsenal, and NASA. This episode was written by Nathaniel Nelson, narrated by Christopher Luft and produced by the team at LimaCharlie.

#179 - Hacker Holidays: Operation Flyhook

LimaCharlie — Fri, 27 Dec 2024 07:05:31 -0100

In this episode, we recount the story of Operation Flyhook - an FBI sting operation in 2000 that resulted in the arrest of two Russian hackers on American soil. It is quite the story and leaves us with some pretty heavy conclusions. This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie. Any questions or feedback can be directed to defenders@limacharlie.io

#178 - Intel Chat: ptcpdump, Target adopts TLSH, Clop, XLoader & HeartCrypt

LimaCharlie — Sat, 21 Dec 2024 02:17:03 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

ptcpdump is an eBPF-based version of tcpdump that adds process information to each packet. It supports filtering by process ID, process name, container ID, and Kubernetes pod name.

In a recent implementation, Target's cybersecurity team adopted TLSH (Trend Micro Locality Sensitive Hash) to improve their malware detection capabilities.

Huntress recently issued a threat advisory regarding active exploitation of a zero-day vulnerability affecting Cleo's file transfer software, specifically impacting LexiCom, VLTrader, and Harmony versions up to 5.8.0.21.

Sublime Security recently analyzed a phishing campaign that impersonates Microsoft SharePoint to deliver the XLoader malware.

Palo Alto Networks' Unit 42 team has uncovered a new packer-as-a-service (PaaS) operation named HeartCrypt, which has been active since July 2023 and began sales in February 2024. HeartCrypt is designed to obfuscate malware, making detection by security solutions more challenging.

#177 - Intel Chat: Supply-Chain Firewall, Scattered Spider, Linux malware & another NTLM exploit

LimaCharlie — Thu, 12 Dec 2024 15:40:28 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Datadog Security Labs has introduced the Supply-Chain Firewall, a new open-source tool designed to protect developers from malicious and vulnerable packages sourced from PyPI and npm repositories.
U.S. authorities have arrested 19-year-old Remington Goy Ogletree, known online as "remi," for allegedly breaching a U.S. financial institution and two unnamed telecommunications firms.
A recent study titled "A Study of Malware Prevention in Linux Distributions" examines the challenges of preventing and detecting malware within Linux distribution package repositories.
A recently identified zero-day vulnerability affects all modern versions of Windows Workstation and Server operating systems, from Windows 7 and Server 2008 R2 up to the latest Windows 11 v24H2 and Server 2022.

And you can subscribe to Detection Engineering Weekly here.

#176 - The reality of modern browser threats with John Tuckner, Founder at Secure Annex

LimaCharlie — Tue, 10 Dec 2024 15:16:45 -0100

On this episode of The Cybersecurity Defenders Podcast we explore the reality of modern browser threats with John Tuckner, Founder at Secure Annex.

John, the founder of Secure Annex, an innovative platform focused on helping organizations manage and secure browser extensions. With over a decade of experience in cybersecurity and technical program management, they have held key leadership roles at companies like Tines, Cyderes, and Optiv. At Tines, they spearheaded multiple initiatives, including the creation of Tines Labs, the development of a natural language AI workflow tool, and the expansion of the Tines Library of automation workflows.

John’s career also includes building customer success engineering teams, driving security automation research, and implementing cutting-edge network and security solutions. They bring a wealth of expertise in creating scalable frameworks, strategic tools, and impactful automation technologies.

#175 - Intel Chat: Hydra dark web, DOC entity list, Venom Spider & flowbreaking,

LimaCharlie — Fri, 06 Dec 2024 15:50:19 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Russian courts have sentenced Stanislav Moiseyev, the leader of the Hydra dark web marketplace, to life imprisonment.

The U.S. Commerce Department has expanded its export controls, adding nearly 140 Chinese technology companies to its "entity list." This action primarily targets firms involved in the production of computer chips, chipmaking tools, and related software, including Chinese-owned entities operating in Japan, South Korea, and Singapore.

Researchers have uncovered new malware strains, RevC2 and Venom Loader, tied to the sophisticated threat actor known as Venom Spider.

Recent analyses have identified a critical vulnerability in generative AI systems, termed "flowbreaking" exploits, which can lead to unintended data leaks.

#174 - Predictions for the future of cybersecurity from 2024

LimaCharlie — Wed, 04 Dec 2024 19:33:19 -0100

A special episode of The Cybersecurity Defenders Podcast, where we look back at our conversations throughout 2024, and bring together all of the predictions for the future of cybersecurity.

#173 - Intel Chat: ClickFix, Raspberry Robin, Gelsemium, Fancy Bear & Salt Typhoon

LimaCharlie — Thu, 28 Nov 2024 14:43:48 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

In recent months, cybersecurity researchers have observed a surge in the use of a social engineering technique known as "ClickFix." This method involves threat actors presenting users with deceptive error messages that prompt them to manually execute malicious commands, often by copying and pasting scripts into their systems.
Raspberry Robin, also known as Roshtyak, is a highly obfuscated malware first discovered in 2021, notable for its complex binary structure and advanced evasion techniques. It primarily spreads via infected USB devices and employs multi-layered execution to obscure its true purpose.
A China-linked Advanced Persistent Threat (APT) group, Gelsemium, has been observed targeting Linux systems for the first time, deploying previously undocumented malware in an espionage campaign. Historically known for targeting Windows platforms, this new activity signifies a shift towards Linux, possibly driven by the increasing security of Windows systems.
Russia’s APT28 hacking group, also known as Fancy Bear or Unit 26165, has developed a novel technique dubbed the “nearest neighbor attack” to exploit Wi-Fi networks remotely.
Hackers linked to the Chinese government, known as Salt Typhoon, have deeply infiltrated U.S. telecommunications infrastructure, gaining the ability to intercept unencrypted phone calls and text messages. The group exploited vulnerabilities in the wiretap systems used by U.S. authorities for lawful interception, marking what Senator Mark Warner has called "the worst telecom hack in our nation's history."

#172 - Cybercrime cottage industries with Reed McGinley-Stempel, the Co-Founder and CEO of Stytch

LimaCharlie — Wed, 27 Nov 2024 07:30:13 -0100

On today's episode of The Cybersecurity Defenders Podcast we talk about cybercrime cottage industries with Reed McGinley-Stempel, the Co-Founder and CEO of Stytch

Stytch is a platform designed to streamline authentication, authorization, and fraud prevention in a way that enhances security while minimizing user friction. Stytch serves both consumer and B2B applications, offering a variety of authentication solutions, including features like Google One-Tap and Biometrics for consumer-facing applications, as well as SSO, Role-Based Access Control, and SCIM integrations for enterprise SaaS. Reed founded Stytch after witnessing the challenges teams face when building secure and user-friendly authentication solutions, a problem he first encountered while working at Plaid. He is also a proud duke alumni and was the recipient of the prestigious Fullbright Scholarship

#171 - Intel Chat: Snowflake, Scattered Spider, CCP, Melofee backdoor, SilkSpecter & Palo Alto Networks

LimaCharlie — Sat, 23 Nov 2024 20:22:31 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

U.S. authorities have identified and charged individuals responsible for a significant data breach involving Snowflake Inc., a major cloud data warehousing company. The breach resulted in the theft of approximately 50 billion records from AT&T, one of Snowflake's prominent clients.
U.S. prosecutors have charged five individuals, including 22-year-old Scottish national Tyler Buchanan, for their alleged involvement in the cybercrime group Scattered Spider. This group is accused of executing sophisticated phishing attacks that compromised numerous U.S. companies and individuals, leading to the theft of confidential information and cryptocurrency.
The next one is an interesting breakdown on the evolving landscape of Chinese state-sponsored cyber threats that reveals a highly coordinated and multi-layered approach to achieving the strategic objectives of the Chinese Communist Party (CCP).
In July 2024, cybersecurity researchers identified a new variant of the Melofee backdoor, a sophisticated malware associated with the Winnti Advanced Persistent Threat group. This variant specifically targets Red Hat Enterprise Linux 7.9 systems and demonstrates enhanced stealth and persistence mechanisms.
In early October 2024, cybersecurity analysts identified a phishing campaign targeting e-commerce shoppers in Europe and the USA seeking Black Friday discounts. The campaign, attributed to a financially motivated Chinese threat actor dubbed "SilkSpecter," exploited the surge in online shopping during November's Black Friday season.
Palo Alto Networks' Unit 42 has identified exploitation activities targeting two critical vulnerabilities in PAN-OS software: CVE-2024-0012 and CVE-2024-9474.

#170 - A novel path into cybersecurity with Jibby Saetang, Security Researcher with Microsoft GHOST

LimaCharlie — Tue, 19 Nov 2024 07:30:12 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Jibby Saetang, Security Researcher with Microsoft GHOST, about his novel path to a career in cybersecurity.

With over a decade of experience in watch and jewelry repair, Jibby developed an impressive eye for detail and a knack for solving complex problems. These skills translated seamlessly into the world of cybersecurity, where Jibby found an unexpected yet perfect fit. Driven by a passion for learning, Jibby dove into the KC7 platform, an immersive cybersecurity training resource, which ultimately led to a role at Microsoft—all without taking the traditional certification route. Jibby’s story is a testament to the power of persistence, passion, and non-traditional paths in tech. Now, Jibby is focused on helping others break into cybersecurity by developing new KC7 training modules, aiming to inspire and equip the next generation of problem-solvers.

#169 - Intel Chat: Tools, N. Korean IT workers, GootLoader, FakeBat & Pacific Rim

LimaCharlie — Fri, 15 Nov 2024 07:30:12 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled.
CVE2CAPEC is a tool developed by Galeax that automates the process of mapping Common Vulnerabilities and Exposures (CVEs) to Common Weakness Enumerations (CWEs), Common Attack Pattern Enumeration and Classification (CAPEC), and MITRE ATT&CK Techniques.
This tool helps security researchers identify vulnerabilities within macOS’s sandbox restrictions, particularly targeting XPC services in the PID domain marked as "Application" services, which often lack adequate protection.
Zscaler's recent blog discusses how North Korean IT professionals are increasingly finding remote work in Western companies, often under disguised identities.
In a recent campaign, GootLoader malware has been targeting Bengal cat enthusiasts in Australia using SEO poisoning tactics.
After a multi-month absence, the malware loader FakeBat—also known as Eugenloader or PaykLoader—has resurfaced, distributing malware through Google Ads, with a recent campaign exploiting ads for the popular app Notion.
Over the past five years, Sophos has been engaged in a complex battle against Chinese state-sponsored cyber adversaries targeting its firewall products. This prolonged engagement, detailed in Sophos' "Pacific Rim" report, reveals a series of sophisticated attacks aimed at exploiting vulnerabilities in internet-facing devices, particularly those within critical infrastructure sectors across South and Southeast Asia.

#168 - Intel Chat: Latrodectus, WarmCookie, FortiManager, EU's Product Liability Directive & Linus Torvalds

LimaCharlie — Thu, 31 Oct 2024 21:33:11 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

VMRay's analysis on Latrodectus highlights the malware family’s development, detailing how it evolved from simple loaders to highly evasive, sophisticated malware.
The WarmCookie malware is a recent, persistent threat known for its self-updating capabilities, specifically designed to evade security tools and establish long-term presence in systems.
Fortinet recently disclosed a critical zero-day vulnerability in its FortiManager product, assigned CVE-2024-47575, which has been actively exploited in the wild.
The European Union (EU) recently updated its product liability framework to better address the challenges of the digital age and support the shift toward a circular economy.
Linux creator Linus Torvalds recently reaffirmed the expulsion of Russian maintainers from the Linux MAINTAINERS file due to sanctions compliance, sparking discussion within the open-source community.

#167 - Running and MDR company with Joshua Sitta, Co-Founder and CTO at Sittadel

LimaCharlie — Wed, 30 Oct 2024 18:13:18 -0100

On this episode of The Cybersecurity Defenders Podcast we talk about running and MDR company with Joshua Sitta, Co-Founder and CTO at Sittadel.

My guest today is Joshua Sitta, the co-founder and CTO of Sittadel, a cybersecurity company specializing in 24/7/365 Managed Detection and Response services. With a focus on enterprise-grade EDR solutions, Sittadel provides comprehensive cybersecurity monitoring and incident response. Before founding Sittadel, Joshua served as the Director of Enterprise Security Architecture at SouthState Bank, where he built a robust in-house cybersecurity program that safeguarded billions in assets. He brings a deep expertise in protecting organizations from modern cyber threats.

#166 - Intel Chat: Microsoft logs, USDoD, SolarWinds WHD, & CISA KEV

LimaCharlie — Thu, 24 Oct 2024 08:08:04 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Microsoft has recently confirmed that a software bug caused the loss of more than two weeks' worth of critical security logs from several of its cloud services.
Brazil’s Federal Police have arrested a hacker suspected to be "USDoD," a notorious cybercriminal involved in several high-profile data breaches.
A critical vulnerability has been discovered in SolarWinds' Web Help Desk (WHD) software, involving hardcoded credentials that could be exploited by attackers.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that these flaws are being actively used in cyberattacks.

#165 - How AI is revolutionizing compliance with Dr. Gaurav Banga, CEO of Balbix

LimaCharlie — Wed, 23 Oct 2024 07:18:50 +0000

On this episode of The Cybersecurity Defenders Podcast we examine how AI is revolutionizing compliance with Dr. Gaurav Banga, CEO of Balbix.

Gaurav Banga, the CEO and Founder of Balbix, an AI-powered cybersecurity risk management startup. Gaurav is an accomplished inventor with over 50 patents to his name, and he has a deep background in founding and leading multiple successful tech ventures. His journey into entrepreneurship is unique—it began over a decade ago when he was inspired by a book that eventually led him to leave academia and pursue his passion for deep tech.

Gaurav regularly speaks with CISOs, gaining firsthand insights into their biggest challenges as they navigate an increasingly complex cybersecurity landscape. As regulatory scrutiny around security disclosures intensifies, Gaurav offers a unique perspective on how AI can reshape the future of risk management, helping organizations strike the right balance between innovation and security.

#164 - Intel Chat: Wazuh, .io, AI, Discord, Palo Alto & GoldenJackal

LimaCharlie — Mon, 21 Oct 2024 14:04:38 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A recent malware campaign has been discovered that exploits the open-source Wazuh SIEM agent to deliver a cryptomining payload.
There is uncertainty surrounding the .io domain following the UK’s decision to return the Chagos Islands, including the British Indian Ocean Territory, to Mauritius.
The October 2024 report, "Influence and Cyber Operations," explores how AI is being leveraged by both state and non-state actors in cyber campaigns. Key findings show that AI tools are increasingly being used to enhance traditional cyberattacks, particularly in areas like vulnerability research, malware debugging, and influence operations.
Discord has recently been blocked in both Russia and Turkey due to claims of illegal activity on the platform.
Palo Alto Networks recently patched several critical vulnerabilities in its Expedition tool, which could allow attackers to take control of firewall systems. The most severe flaw, CVE-2024-9463, allows unauthenticated attackers to execute arbitrary OS commands as root, exposing sensitive data like usernames, passwords, and API keys.
The article from ESET highlights a cyberespionage campaign conducted by a group known as GoldenJackal, which is targeting government and diplomatic entities, focusing specifically on air-gapped systems in regions such as Europe, the Middle East, and South Asia.

#163 - Practical applications of AI in cybersecurity with Rich Heimann, AI researcher & author

LimaCharlie — Thu, 17 Oct 2024 15:27:50 +0000

On this episode of The Cybersecurity Defenders Podcast we speak with Rich Heimann, AI researcher and author.

Rich is a visionary leader in artificial intelligence and business transformation. As a Chief Artificial Intelligence Officer, Rich has a proven track record of developing and deploying AI solutions that drive measurable impact across a range of industries. Known for his ability to blend technical expertise with strategic insight, he consistently helps organizations unlock the full potential of AI to achieve real business results. Rich is also committed to ethical AI practices and excels at building innovative, high-performing teams. He’s recently authored a new book titled Generative Artificial Intelligence Revealed.

#162 - Intel Chat: FIN7, COLDRIVER, perfectly, Comcast & EKUwu

LimaCharlie — Thu, 10 Oct 2024 14:30:59 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Silent Push's recent analysis reveals new tactics by the FIN7 cybercriminal group, which is leveraging AI-based “DeepNude Generators” as part of a phishing campaign to spread malware.
Microsoft's Digital Crimes Unit (DCU), in partnership with the U.S. Department of Justice, has taken steps to dismantle cyber operations by Star Blizzard, a Russian state-affiliated actor also known as COLDRIVER.
Aqua Security's detailed research on perfctl describes it as a highly stealthy malware that targets Linux servers using a range of sophisticated methods.
Comcast recently disclosed that over 237,000 customers had their personal data compromised due to a ransomware attack targeting a former debt collection agency, Financial Business and Consumer Solutions (FBCS).
TrustedSec's research on EKUwu sheds light on a significant Active Directory Certificate Services (AD CS) vulnerability that allows attackers to misuse version 1 certificate templates.

Stats on business outcomes after breaches referenced by Matt.

#161 - Intel Chat: MSSN CTRL, CRI summit, Shadow AI, More_Eggs, Andariel hacking group & DrayTek routers

LimaCharlie — Tue, 08 Oct 2024 17:50:25 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The White House recently hosted the International Counter Ransomware Initiative (CRI) summit, bringing together representatives from 68 countries to address the growing global threat of ransomware.
The rise of "Shadow AI," which refers to the unauthorized use of AI tools by employees without the oversight of IT departments, poses significant risks for organizations.
A new wave of attacks leveraging the More_Eggs backdoor malware has been specifically targeting recruiters. TA4557, a financially motivated group linked to North Korea, has been distributing this backdoor since late 2023.
The Andariel hacking group, a subgroup of North Korea’s Lazarus Group, has turned its attention to financially motivated attacks against U.S. organizations.
Forescout Vedere Labs has uncovered 14 vulnerabilities affecting over 700,000 DrayTek routers, with two critical flaws posing significant security risks.

#160 - Cryptocurrency and its role in money laundering with BBC journalist and author Geoff White

LimaCharlie — Thu, 03 Oct 2024 20:17:28 +0000

On this episode of The Cybersecurity Defenders Podcast, we dive into cryptocurrency and it’s role in money laundering with BBC journalist and author Geoff White.

Geoff is an accomplished author, speaker, investigative journalist, and podcast creator with over 20 years of experience, focusing on organized crime and technology. He has worked with major outlets including the BBC, Audible, Penguin, Sky News, and The Sunday Times, covering topics such as financial crime, money laundering, cryptocurrency, and cybercrime. His recently released book, Rinsed, dives into how technology is transforming the money laundering industry, and was published by Penguin back in June of 2024.

His previous book, The Lazarus Heist, followed the success of the hit BBC podcast series he co-hosted, which investigated North Korea’s cyber operations. He’s also the author of Crime Dot Com, which explores the global rise of hacking, and has created multiple podcast series for Audible, including The Dark Web and Artificial Intelligence: Friend or Foe?

In addition to writing, he is a sought-after public speaker who has given keynote talks for brands like Microsoft, MasterCard, and HSBC. He has also won numerous awards for his reporting, including his work on the Snowden leaks and his investigations into internet fraud.

Rinsed: From Cartels to Crypto How the Tech Industry Washes Money for the World's Deadliest Crooks

#159 - Intel Chat: Sequoia disruption, Github, Supershell, DPRK & Telegram arrest

LimaCharlie — Mon, 30 Sep 2024 07:30:12 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Apple’s release of macOS 15, or Sequoia, has caused significant disruptions for several security tools and software vendors, including CrowdStrike, SentinelOne, Microsoft, and others.
Attackers are exploiting GitHub notifications for phishing by sending legitimate-looking alerts with malicious URLs.
Truffle Security's research exposes a significant issue in GitHub’s handling of deleted and private repository data via Cross Fork Object Reference (CFOR).
AhnLab’s report details Supershell, a malware targeting Linux SSH servers via brute-force attacks.
Since 2022, Mandiant has tracked DPRK IT workers infiltrating global organizations by posing as non-North Koreans to fund the regime's weapons programs and evade sanctions.
In August 2024, Telegram CEO Pavel Durov was arrested in France, facing charges for allowing criminal activities to proliferate on the platform, including the distribution of illegal content such as child sexual abuse material.

#158 - Common pitfalls for founders with Andrew Plato, Founder & CEO of Zenaciti

LimaCharlie — Thu, 26 Sep 2024 19:31:34 +0000

On this episode of The Cybersecurity Defenders Podcast we talk about some of the common pitfalls faced by founders with Andrew Plato, Founder & CEO of Zenaciti.

Andrew is an experienced CEO, founder, author, and cybersecurity expert. In 1995, Andrew founded Anitian, one of the earliest cybersecurity companies on record, where he pioneered innovations in intrusion detection, endpoint security, and cloud security. He led the development of a revolutionary automated platform for secure cloud environments, and under his leadership, Anitian formed strategic partnerships with major tech companies like AWS, Microsoft, and Trend Micro before he exited the company in 2022. Andrew also leads Zenaciti, providing business and security intelligence, and recently founded Screenopolis, focusing on media analysis. He is also the author of The Founder’s User Manual: Practical Strategies for the Startup Leader.

#157 - Low noise threat detection with Joshua Neil, Founder at Alpha Level

LimaCharlie — Tue, 24 Sep 2024 11:59:28 +0000

On this episode of The Cybersecurity Defenders Podcast we talk about low noise threat detection with Joshua Neil, Founder at Alpha Level.

Josh is a seasoned expert with over 20 years of experience in developing data-driven solutions to security challenges faced by both the U.S. Government and industry at large. With a deep understanding of enterprise security, they are focused on the fact that perimeter defenses alone aren't enough to prevent attackers from breaching systems. They emphasize the importance of visibility into enterprise behavior, the need for statistical methods in attack detection, and the interconnected nature of attacks across multiple endpoints. Their work revolves around quantifying security-relevant rare events and leveraging context to support analysts in distinguishing true breaches from false positives.

Statistical Inference by George Casella and Roger Berger

#156 - Intel Chat: Fortibitch, Hadooken, Void Banshee & CloudImposer

LimaCharlie — Fri, 20 Sep 2024 07:30:12 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Fortinet responded by confirming that the breach involved unauthorized access to files on a third-party cloud-based shared drive, affecting a small portion of customer data.
Hackers are targeting Oracle WebLogic servers with a new Linux malware named "Hadooken," which is designed to deploy a cryptominer and facilitate distributed denial-of-service (DDoS) attacks.
Microsoft has reclassified a previously patched bug, CVE-2024-43461, as a zero-day vulnerability actively exploited by the "Void Banshee" threat group.
Security researchers from Tenable revealed a critical remote code execution vulnerability in Google Cloud Platform that could have allowed attackers to run malicious code on millions of Google’s servers.

#155 - A look at quantum cryptography with David Carvalho, CEO & Chief Scientist at Naoris Protocol

LimaCharlie — Thu, 19 Sep 2024 07:30:12 +0000

On this episode of The Cybersecurity Defenders Podcast we take a look at quantum cryptography with David Carvalho, CEO & Chief Scientist at Naoris Protocol.

David is the founder, CEO, and Chief Scientist of Naoris Protocol, a decentralized cybersecurity mesh. David is an accomplished leader and innovator who advises nation-states and highly regulated sectors on critical issues such as cyber espionage, cyber warfare, and cyber terrorism. He is deeply involved in blockchain-based projects, digital currencies, and cybersecurity innovations. With over 20 years of experience in the field, David has worked as a Chief Information Security Officer in multi-billion-dollar companies and brings a forward-thinking approach to risk mitigation, automation, AI, and next-gen cybersecurity. He continues to advise a wide range of organizations, from startups to national-level projects, on transformative strategies for the future.

#154 - Intel Chat: Specula, Chromium, Mustang Panda & Service for America

LimaCharlie — Thu, 12 Sep 2024 07:30:13 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The Specula C2 framework represents a sophisticated attack method that transforms Microsoft Outlook into a command-and-control system by exploiting its Home Page feature.
Attackers exploit browser notifications in Chromium-based browsers by tricking users through CAPTCHA-like prompts to enable notifications.
The Biden administration has launched an initiative aimed at addressing the growing cybersecurity talent shortage, which has reached critical levels.
Mustang Panda, a Chinese state-backed cyber-espionage group, has adapted its tactics by launching a USB-based attack campaign that leverages a worm for self-propagation across air-gapped networks.

#153 - Unpacking the hacker mindset with Ken Westin, Senior Solutions Engineer at LimaCharlie

LimaCharlie — Tue, 10 Sep 2024 07:30:12 +0000

On this episode of The Cybersecurity Defenders Podcast, we unpack the hacker mindset with Ken Westin, Senior Solutions Engineer at LimaCharlie.

Ken is a seasoned thought leader in cybersecurity who has spent years analyzing and understanding the intricacies of cyber threats and the methods behind them. Ken has a unique ability to identify emerging trends in the industry and for figuring out how businesses can protect themselves before they fall victim to attacks.

Previous to his current role, Ken was the Field CISO at Panther, where he developed workshops and delivered them around the world. His career also includes significant contributions at Cybereason, Elastic, and Splunk, where he drove security growth, developed innovative tools, and shaped industry conversations on cybersecurity. Ken has been a key spokesperson in the industry, frequently quoted in the media and featured at major conferences like Black Hat and DEF CON.

Ken recently joined the team at LimaCharlie as a Senior Solutions Engineer, with the intent to use his deep expertise to help organizations build robust security strategies.

Ken's reading list:

“Daemon” - Daniel Suarez

“Cryptonomicon” - Neal Stephenson

“The Myth of Normal” - Gabor Maté

“Threats: What Every Engineer Should Learn From Star Wars” - Adam Shostack

“The Mitrokhin Archive” Christopher Andrew & Vasili Mitrokhin

“The Road” - Cormac McCarthy

The song at the end of the podcast:

Decrypted Savant - Mercator Misconceptions

#152 - Intel Chat: sedexp, Volt Typhoon, Citrine Sleet, Clearview AI & RansomHub?

LimaCharlie — Thu, 05 Sep 2024 13:35:23 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A stealthy Linux malware named 'sedexp' has been evading detection since 2022 by using a persistence technique not yet included in the MITRE ATT&CK framework.
The Black Lotus Labs team at Lumen Technologies have uncovered a group of hackers linked to the Chinese government which have exploited a previously unknown software vulnerability to target U.S. internet service providers.
Earlier in August, a North Korean hacking group exploited a previously unknown bug in Chrome-based browsers, aiming to steal cryptocurrency, which was reported by Microsoft in a recent update.
The Dutch Data Protection Authority, or Dutch DPA, has hit Clearview AI with a €30.5 million fine—about $33.7 million—for illegally collecting data using facial recognition, including photos of Dutch citizens.
Energy giant Halliburton has confirmed that its systems were hacked, and intruders were able to steal information following a cyberattack last week.

#151 - Exploring AI as it pertains to cybersecurity with George Gerchow, Head of Trust at MongoDB

LimaCharlie — Wed, 28 Aug 2024 17:09:05 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with George Gerchow, Head of Trust at MongoDB, about the current narrative surrounding AI in cybersecurity. George challenges the dominant focus on AI as a threat and instead highlights its potential as a powerful ally in defending against sophisticated cyberattacks. We explore how AI-driven defense strategies are reshaping the landscape of proactive threat detection and automated response mechanisms, offering a fresh perspective on balancing security innovation with risk management.

George is an experienced executive who has played a key role in guiding highly regulated organizations as they establish and develop agile security, privacy, and compliance programs in fast-paced environments. George’s strong focus on relationships and customer engagement shines through in every interaction, both within his teams and with external clients. He is adept at implementing risk-based security programs that align with overall business objectives, effectively balancing risk reduction with cost management. During his six years at Sumo Logic, George was integral to the team's success in taking the company public and achieving FedRAMP Authorization. Currently, he serves as the Head of Trust at MongoDB, where he continues to drive excellence in security and compliance.

#150 - Intel Chat: Azure MFA, 2.9b records leaked, CVE 9.8 & ransomware record

LimaCharlie — Fri, 23 Aug 2024 16:47:52 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Starting in October, all Microsoft Azure customers will be required to have multi-factor authentication (MFA) enabled on their accounts.
Documents from a lawsuit revealed that over 2.9 billion records are vulnerable after a massive hack of the Florida-based National Public Data network.
Microsoft recently advised of a critical TCP/IP Remote Code Execution Vulnerability dubbed CVE 2024-38063, which is a critical unauthenticated Remote Code Execution - or RCE - vulnerability within the Windows TCP/IP stack.
Ransomware victims have paid $459,800,000 to cybercriminals in the first half of 2024, setting the stage for a new record this year if ransom payments continue at this level.

#149 - Product security with Jacob Salassi, Co-Founder at stealth startup

LimaCharlie — Tue, 20 Aug 2024 15:16:40 +0000

On this episode of The Cybersecurity Defenders Podcast we speak with Jacob Salassi, Co-Founder at stealth startup, about product security.

Jacob brings over 10 years of experience in software engineering and cybersecurity to the table. Until four months ago, Jacob was a Security Architect at Snowflake, where he ensured every developer was wildly successful in owning security. Since then, he’s been diving into something new and exciting, working on a stealth startup. Before Snowflake, Jacob was busy bootstrapping application security programs in healthcare and engineering secure distributed systems for a hybrid-cloud security platform. He’s passionate about creating a development security experience that not only measurably reduces risk but also earns the love of engineers. In his own words, Jacob solves problems.

Books mentioned in the podcast:

Engineering Trustworthy Systems: Get Cybersecurity Design Right the First Time

Security Engineering: A Guide to Building Dependable Distributed Systems

Measuring and Managing Information Risk: A FAIR Approach

#148 - Intel Chat: Hacker Summer Camp, N. Korea, Dispossessor, Proofpoint & Sinkclose

LimaCharlie — Wed, 14 Aug 2024 13:42:21 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A heated dispute at DEF CON over the custom electronic badges this year turned physical, leading to an altercation between two attendees.
The U.S. Department of Justice has charged Matthew Isaac Knoot, a 38-year-old Nashville resident, with multiple crimes for aiding North Korean IT workers in securing jobs with U.S. and U.K. companies.
The FBI has dismantled the infrastructure of the Dispossessor ransomware group, also known as Radar, which had rapidly gained prominence since its inception in August 2023.
A critical flaw in Proofpoint’s email filtering service was recently discovered, allowing cybercriminals to impersonate major brands and send phishing emails that bypassed Proofpoint’s security.
A newly discovered security flaw affects AMD processors dating back to 2006. The vulnerability, which impacts CPUs from the Athlon 64 to the Ryzen 7000 series, allows attackers to exploit speculative execution to access sensitive data.

#147 - Cybersecurity product development with Vijay Pitchuman, Director of Product for Identity Management at Okta

LimaCharlie — Wed, 07 Aug 2024 15:27:49 +0000

On this episode of The Cybersecurity Defenders Podcast we talk about cybersecurity product development with Vijay Pitchuman, Director of Product for Identity Management at Okta.

#146 - Intel Chat: GhostEmperor, .top, PlugX & Microsoft

LimaCharlie — Wed, 31 Jul 2024 11:47:35 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The Chinese hacker group GhostEmperor has re-emerged after a two-year hiatus, displaying new advanced capabilities and sophisticated evasion techniques.
The Chinese company, Jiangsu Bangning Science & Technology Co., in charge of handing out domain names ending in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains.
Following a report by the cybersecurity firm Sekoia.io, the Paris Public Prosecutor’s Office launched a preliminary investigation into a botnet involving millions of global victims, including thousands of machines in France.
Microsoft has initiated significant changes to its Windows operating system following a critical incident involving CrowdStrike's kernel driver.

#145 - Exploring threat intelligence with Jamie Williams, Threat Intelligence Researcher at Unit 42

LimaCharlie — Tue, 30 Jul 2024 07:02:42 +0000

On this episode of the Cybersecurity Defenders podcast, we explore threat intelligence with Jamie Williams, Threat Intelligence Researcher at Palo Alto Networks' Unit 42.

Jamie is a seasoned professional in the field of cybersecurity. Before joining Unit 42, he made significant contributions at the MITRE Corporation as a Senior Principal Cyber Operations Engineer. During his tenure at MITRE, Jamie led the development of MITRE ATT&CK® for Enterprise, focusing on adversary emulation and behavior-based detections.

In addition to his full-time role, Jamie is also a member of the IANS Faculty, where he shares his extensive knowledge and experience with the cybersecurity community. With a rich background that includes time at the National Security Agency, Jamie brings a wealth of expertise to the podcast.

Katie Nickels blog can be found here.

Google Mandiant's article on requirement-driven intelligence can be found here.

#144 - How to think about IR with Lee Sult, Chief Investigator at Binalyze

LimaCharlie — Fri, 26 Jul 2024 14:53:11 +0000

On this episode of The Cybersecurity Defenders Podcast we sit down with Lee Sult, Chief Investigator at Binalyze, and talk about incident response (IR).

Lee is a seasoned cybersecurity expert and investigator with extensive experience in digital forensics and incident response. He is the Chief Investigator at Binalyze and has a strong track record at prestigious organizations like Trustwave-SpiderLabs and Palantir. Lee has supported the US Secret Service and managed complex cybersecurity incidents for Fortune 50 companies.

As the co-founder and former CTO of Horangi Cyber Security, Singapore's first cybersecurity startup, Lee's leadership and collaboration skills have significantly impacted the region's cybersecurity landscape. Passionate about mentoring, Lee actively contributes to cybersecurity communities and supports up-and-coming entrepreneurs.

#143 - Intel Chat: Blast-RADIUS, Chrome, AT&T, Kaspersky & Crowdstrike

LimaCharlie — Wed, 24 Jul 2024 07:30:11 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Blast-RADIUS is a vulnerability in the RADIUS protocol that allows a man-in-the-middle attacker to forge valid protocol accept messages in response to failed authentication requests.
The blog post on Syntax-Err0r details a technique for silently installing a Chrome extension to maintain persistence, bypassing typical detection methods.
American telecom service provider AT&T has confirmed that threat actors managed to access data belonging to "nearly all" of its wireless customers as well as customers of mobile virtual network operators using AT&T's wireless network.
The U.S. Department of Commerce added Kaspersky to its Entity List, barring U.S. businesses from engaging with the company due to national security concerns related to the Russian government's influence over Kaspersky's operations.
On July 19th Crowdstrike distributed a faulty update to its Falcon sensors that caused widespread problems with computers running Microsoft Windows. As a result, roughly 8.5 million systems crashed, bringing up the feared blue screen of death, in what is being called the largest IT outage in history (+outage 1-month ago, +outage 3-months ago).

#142 - Threat detection & research with Zack Allen, Security Detection & Research Leader at Datadog

LimaCharlie — Fri, 19 Jul 2024 13:34:21 +0000

On this episode of The Cybersecurity Defenders Podcast we talk threat detection & research with Zack Allen, Security Detection & Research Leader at Datadog.

Zack is a seasoned security research, engineering, and product leader with over a decade of experience in building organizations that create impactful security for customers. Zack specializes in threat research and intelligence, cloud security, software engineering, and DevOps. His expertise has significantly contributed to advancing the field of cybersecurity. He is also the visionary behind Detection Engineering Weekly, a platform that provides insights and updates on the latest in detection engineering.

You can subscribe to Zack's newsletter here.

#141 - The Rescue of Evelyn Chang by Gene Yu, Founder & CEO of Blackpanda

LimaCharlie — Thu, 11 Jul 2024 08:32:00 +0000

On this episode of The Cybersecurity Defenders Podcast we speak with Gene Yu, Founder & CEO of Blackpanda.

Gene has a diverse background, with early roles at Palantir's Asia office and Credit Suisse on Wall Street. He also served as a team leader in the US Army Special Forces, completing four combat tours in Iraq and the Southern Philippines. Gene is an active angel investor, renowned for leading the successful rescue of Evelyn Chang from Abu Sayyaf terrorists in 2013. He graduated with top honors in computer science from West Point and has attended Johns Hopkins University and Stanford's Executive Program.

Gene’s book, about the incredible rescue of Evelyn Chang, can be purchased here.

#140 - Intel Chat: 10bn Pwds, Eldorado RaaS, 840Mpps DDoS, regreSSHion & $1.4bn in stolen crypto

LimaCharlie — Wed, 10 Jul 2024 15:03:05 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Likely the biggest password leak ever: nearly 10 billion credentials exposed.
Eldorado is a newly discovered ransomware-as-a-service operation targeting both Windows and Linux systems.
OVHcloud has reported mitigating a record-breaking distributed denial-of-service attack that peaked at 840 million packets per second.
Cisco has issued a warning about a critical remote code execution vulnerability named "regreSSHion," tracked as CVE-2024-6387, affecting OpenSSH on glibc-based Linux systems.
In the first half of 2024, cryptocurrency thefts amounted to $1.4 billion, significantly driven by rising crypto prices and a few large-scale attacks.

#139 - Intel Chat: MOVEit, P2PInfect, polyfill.io & TeamViewer

LimaCharlie — Thu, 04 Jul 2024 09:09:58 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A high-severity security vulnerability in Progress Software's MOVEit Transfer software could allow cyberattackers to get around the platform's authentication mechanisms — and it's been spotted being actively exploited in the wild just hours after it was made public.
A new version of the P2P worm, P2PInfect, that targets Redis servers running on both Linux and Windows systems, which is aimed at deploying both ransomware and cryptocurrency mining payloads, is out in the wild.
The polyfill.io domain, used for providing backward compatibility for older browsers, has been shut down amid accusations of malicious activity after recently being acquired by Chinese firm Funnull, and was allegedly redirecting users to malicious sites and employing evasion techniques.
The Germany-based company behind the world-famous remote desktop software TeamViewer has confirmed that in 2016 TeamViewer software was compromised.

#138 - Automating security detection engineering with Dennis Chow, Security Engineer at EY

LimaCharlie — Tue, 02 Jul 2024 07:07:49 +0000

On this episode of The Cybersecurity Defenders Podcast, we talk about automating security detection engineering with Dennis Chow, Security Engineer at EY.

Dennis is a multi-industry and seasoned cybersecurity operations leader. Using his experience, he helps organizations achieve their maximum security potential through hybrid training, sec ops management, engineering, and cross-disciplinary integration. He is also a published author, and a veteran of the armed forces.

Dennis Chow's book on Automating Security Detection Engineering can be purchased here.

Megan Rodie's book on Practical Threat Detection Engineering can be purchased here.

#137 - Exploring AI-powered cybersecurity with Rodrigo Loureiro, CEO of Cyber Connective Corporation

LimaCharlie — Fri, 28 Jun 2024 17:10:34 +0000

On this episode of The Cybersecurity Defenders Podcast, we talk AI-powered cybersecurity with Rodrigo Loureiro, CEO of Cyber Connective Corporation.

Rodrigo's extensive experience includes roles as a global Chief Information Officer where he managed a $215M IT budget and oversaw a team of 1800 people, ensuring world-class infrastructure services around the clock.

In addition to his executive roles, Rodrigo is a bestselling author of 'Game On - Leaders Who Last', where he explores the necessity of adaptability and open-mindedness in leadership, particularly within the technology sector. He is also an Operational Partner at the Executive Enterprise Venture Fund, focusing on innovative cybersecurity and AI investments. A recognized keynote speaker and expert in aligning technology with business strategy, Rodrigo’s insights are invaluable to anyone interested in the future of tech and leadership.

#136 - Special Episode: The ongoing CDK Global cybersecurity incident

LimaCharlie — Wed, 26 Jun 2024 08:31:44 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak MIke Pedrick and Adriano Carvalho about the ongoing CDK Global cybersecurity incident.

Mike Pedrick is an experienced cybersecurity practitioner with too many certs to list off. He makes his way through the world as a vCISO and happens to have a deep interest in the automobile sector.

Adriano Carvalho is consulting partner with the Reynolds and Reynolds company, who has spent over 10 years immersed in the automotive industry.

The incident: CDK Global experienced a significant cyberattack starting on June 18, 2024, which led to the shutdown of its systems affecting approximately 15,000 automotive dealerships across the United States. The company, which provides crucial software solutions for dealership management, had to proactively shut down most of its IT systems to prevent the spread of the attack. This resulted in a major disruption of dealership operations, forcing employees to revert to manual processes such as writing work orders by hand.

CDK Global has been working with third-party experts to investigate the incident and has started to restore some of its services, including the core dealer management system. However, the full resolution of the issue is expected to take several days, and the company is continuously updating its customers on the progress. The company has emphasized that its priority is the security of its customers and is taking extensive measures to ensure systems are safe before bringing them back online.

The impact of the cyberattack has left many dealerships unable to conduct regular business activities, significantly affecting their operations. CDK Global has not yet disclosed who was behind the attack or if any sensitive data was compromised, but further updates are expected as the investigation continues.

Mike can be found on LinkedIn here.

Adriano can be found on LinkedIn here.

#135 - Intel Chat: Sigma, Scattered Spider, Microsoft, Empire Market & UNC3886

LimaCharlie — Fri, 21 Jun 2024 14:18:25 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

SigmaHQ has introduced Sigma Correlations to enhance its rule-based detection capabilities, allowing for more sophisticated event correlation across multiple Sigma rules.
Tyler Buchanan, a 22-year-old from the UK and alleged leader of the Scattered Spider hacking group, was arrested in Spain.
Microsoft has issued an urgent update for all supported versions of Windows to address a critical Wi-Fi vulnerability, CVE-2024-30078.
Three individuals— Yousef Selassie, Ugochukwu Emmanuel Nwosu, and David Gil—have been charged with operating Empire Market, a dark web marketplace that facilitated over $430 million in illegal transactions.
In September 2022, Mandiant began investigating several intrusions conducted by UNC3886, a China-linked cyber espionage group, after discovering malware in ESXi hypervisors.

#134 - Incident command with Gerard Johansen, Principal Security Solutions Specialist at Red Canary

LimaCharlie — Tue, 18 Jun 2024 12:00:11 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Gerard Johansen, Principal Security Solutions Specialist at Red Canary.

Gerard is a seasoned expert in the field of cybersecurity. Gerard holds the prestigious Certified Information System Security Professional - or CISSP. His extensive career includes serving as a Special Deputy United States Marshal for the FBI's Connecticut Computer Crimes Task Force and working as a Certification and Accreditation Analyst for a federal inter-agency unit. Gerard has conducted numerous technical and non-technical vulnerability assessments for both financial and government organizations, demonstrating his deep expertise in digital forensics and incident response.

With a wealth of experience in risk assessment, cyber threat intelligence, and penetration testing, Gerard is frequently sought after for his knowledge in corporate counterintelligence, threat emulation, and cloud security challenges. He has developed and maintained crucial industry relationships through ongoing professional development and is a trusted resource for information security seminars and training programs.

#133 - Intel Chat: Snowflake, Operation Endgame, Android spoof & Operation Crimson Palace

LimaCharlie — Thu, 13 Jun 2024 18:29:04 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Mandiant has linked a series of data breaches affecting hundreds of Snowflake instances to the use of infostealer malware, primarily targeting non-Snowflake systems to harvest credentials.
Authorities have ramped up something they are calling Operation Endgame which is an effort to capture a fellow that goes by the handle "Odd," the alleged mastermind behind the Emotet botnet.
McAfee has identified a fake Bahrain government Android app masquerading as the Labour Market Regulatory Authority app, and is designed to steal personal data for financial fraud.
A technical deep-dive on Operation Crimson Palace performed by Sophos X-ops: the operation exposes a sophisticated cyberespionage campaign targeting a Southeast Asian government, attributed to Chinese state interests.

#132 - API security with Jeremy Snyder, Founder and CEO at FireTail.io

LimaCharlie — Wed, 12 Jun 2024 12:00:11 +0000

On this episode of The Cybersecurity Defenders Podcast, we talk API security with Jeremy Snyder, Founder and CEO at FireTail.io.

FireTail.io is a pioneering company specializing in end-to-end API security. With APIs being the number one attack surface and a significant threat to data privacy and security, Jeremy and his team are at the forefront of protecting sensitive information in an increasingly interconnected world.

Jeremy brings a wealth of experience in cloud, cybersecurity, and data domains, coupled with a strong background in M&A, international business, business development, strategy, and operations. Fluent in five languages and having lived in five different countries, he offers a unique global perspective on cybersecurity challenges and innovations.

FireTail.io's data breach tracker.

vacuum - The world's fastest OpenAPI & Swagger linter.

Nuclei - Fast and customisable vulnerability scanner based on simple YAML based DSL.

#131 - Network threat hunting with Chris Brenton, COO at Active Countermeasures

LimaCharlie — Thu, 06 Jun 2024 15:15:37 +0000

On this episode of The Cybersecurity Defenders Podcast, we talk network threat hunting with Chris Brenton, COO at Active Countermeasures.

Chris is a dedicated professional with a passion for simplifying the process of threat hunting. Chris is deeply committed to enhancing cybersecurity knowledge through delivering both free and affordable security training. Alongside this, he plays a crucial role in the development of both open-source and commercially accessible threat hunting tools. Whether you’re aiming to sharpen your threat hunting skills or are looking to establish a robust threat hunting program within your organization, Chris is the go-to expert. Stay tuned as we dive deeper into his journey, and feel free to reach out to him directly to learn more or get involved.

You can find Chris on LinkedIn here.

And you can find Chris in Twitter here.

#130 - The changing compliance landscape with Alexander Byrne, Director of Corporate IT Compliance at Thrive

LimaCharlie — Tue, 04 Jun 2024 12:30:09 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Alexander Byrne, Director of Corporate IT Compliance at Thrive.

Alexander is a seasoned expert in crafting dynamic information security and IT compliance strategies tailored to meet the needs of businesses ranging from SMBs to large enterprises. With a solid decade of experience, Alexander has delivered solutions across various industries including information technology, fintech, real estate, e-commerce, energy, and healthcare. His approach not only solves business challenges but also ensures alignment with industry best practices and compliance with regulatory requirements, ultimately enabling sustainable value through the technology and cybersecurity investment cycle.

#129 - Intel Chat: MSSN CTRL, GhostEngine, MITRE & BreachForums

LimaCharlie — Thu, 30 May 2024 13:17:20 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Researchers have identified a new malware, called"GhostEngine," which targets vulnerable drivers to disable endpoint detection and response solutions.
MITRE has released some more details on how Chinese state-sponsored hackers recently exploited VMware systems within MITRE's NERVE environment for persistence and evasion.
The FBI has once again seized control of BreachForums, a notorious site known for trading stolen data, marking the second such action within a year.

Information on MSSN CTRL, the security automation and engineering conference, can be found here.

#128 - Exploring SOAR with Andrew Katz, Senior Information Security Engineer at Jamf

LimaCharlie — Wed, 29 May 2024 13:06:44 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Andrew Katz, Senior Information Security Engineer at Jamf.

Andrew is a seasoned security engineer with a sharp focus on security automation. Over the past nine years, Andrew has honed his expertise in Python, API development, AWS, and Docker to craft sophisticated automated security solutions. His journey includes leading the development of SOAR platforms at Jamf, which enhanced distributed alerting systems to help SOC analysts combat alert fatigue. At Tevora, he offered his skills as a consultant, conducting enterprise-level cybersecurity risk assessments. Andrew's earlier roles as a Systems Engineer at Falck and an Information Technologist at GHD laid the groundwork for his profound understanding of IT, which feeds into his current security prowess. A holder of a CISSP and a Bachelor of Science in Geographic Science and Community Planning, Andrew brings a unique blend of technical skill and strategic insight to the field of cybersecurity.

The Security Engineering Newsletter can be found here: SecEng Newsletter

#127 - Intel Chat: Alabuga Leaks, LockBit, EBury, E2EE & Dropbox

LimaCharlie — Fri, 24 May 2024 06:12:08 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Some of the findings that were revealed by this leak about the inner workings of the Russian company Albatross and its Albatross-M5 UAVs, now being used in the war against Ukraine.
The U.S. Department of Justice has charged Dmitry Yuryevich Khoroshev, a 31-year-old Russian national, as the leader of the LockBit ransomware group.
ESET reveals the persistent threat posed by the Ebury malware, which has compromised approximately 400,000 Linux servers since 2009, which was initially documented in 2014.
Zoom has announced the global rollout of post-quantum end-to-end encryption for its video meetings, a significant step forward in securing communications against future quantum computing threats.
Dropbox recently disclosed a security breach impacting its Dropbox Sign eSignature service.

#126 - Zero Trust architecture with Kane Narraway, Head of Enterprise Security at Canva

LimaCharlie — Tue, 21 May 2024 12:00:10 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Kane Narraway, Head of Enterprise Security at Canva, about Zero Trust architecture.

Kane brings over a decade of experience to the table, specializing in enterprise security, cloud security, and risk management. He's known for his groundbreaking work in building zero trust architectures at some of the world’s largest tech companies, often from scratch during the early days of zero trust when solutions were not readily available.

Kane's career is marked by notable achievements, including integrating multi-billion dollar acquisitions and establishing robust security frameworks for regulations like SOC2, PCI-DSS, and HIPAA. He’s not only a director who has scaled technology companies from startup to enterprise level but also a passionate leader who has nurtured diverse teams, promoting autonomy and inclusivity. Outside of his direct work, Kane is dedicated to giving back to the community—whether it’s sharing cybersecurity insights, mentoring at boot camps, or volunteering at conferences. Join us as we gain insights from his extensive experience and innovative approaches to tackling some of the most complex challenges in cybersecurity today.

Kane's blog can be found here.

#125 - Special Episode: The 2024 Verizon Data Breach Investigations Report

LimaCharlie — Fri, 17 May 2024 22:31:07 +0000

On this episode of The Cybersecurity Defenders Podcast we take a close look at the 2024 Verizon Data Breach Investigations Report.

The Verizon 2024 Data Breach Investigations Report (DBIR) provides a comprehensive analysis of the current cybersecurity landscape, highlighting significant trends and emerging threats. This year's report, the 17th edition, examines 30,458 security incidents and 10,626 confirmed breaches, marking a two-fold increase from the previous year. A key finding is the dramatic surge in vulnerability exploitation, which nearly tripled, driven by attacks on unpatched systems and zero-day vulnerabilities. Ransomware and extortion continue to be major threats, comprising 32% of breaches, with a notable rise in pure extortion attacks where data is stolen but not encrypted.

The report also emphasizes the human element in cybersecurity breaches, with human errors contributing to 68% of incidents. Phishing remains a critical issue, with median times to click on malicious links and submit data being alarmingly short. Despite this, there is an encouraging increase in phishing awareness among users. Additionally, the report underscores the growing complexity of supply chain attacks, highlighting the vulnerabilities in third-party code and services. Interestingly, the impact of generative AI in cyberattacks remains minimal, with most uses being experimental rather than operational. The DBIR concludes with a call for improved vulnerability management and continued focus on human-centric security measures.

You can download the full report here.

#124 - The intersection of CTI & Detection Engineering with Wade Wells, Lead Cybersecurity Threat Detection Engineer

LimaCharlie — Wed, 15 May 2024 14:55:42 +0000

In this episode of The Cybersecurity Defenders Podcast, we take a close look at the intersection of CTI & Detection Engineering with Wade Wells, Lead Cybersecurity Threat Detection Engineer.

Wade Wells, a seasoned cyber security expert whose passion for technology was sparked at an early age. Growing up with a computer built from parts his dad found dumpster diving, Wade learned how to navigate MS-DOS before he could even spell 'windows'. His lifelong fascination with technology and rule-bending led him naturally into the world of cybersecurity. Today, Wade hunts for evil within networks, reveling in the continuous pursuit of knowledge and the thrill of uncovering deeper insights. Join us as we dive into his journey, explore the challenges of threat hunting, and discuss how his work contributes to a greater cause in cybersecurity.

Sublime Security: Email security that's not a black box

Salem Cyber: Find the alerts that actually matter

Practical Threat Detection Engineering: A hands-on guide to planning, developing, and validating detection capabilities

Psychology of Intelligence Analysis

And the TV show Devs.

#123 - The RSA Conference

LimaCharlie — Sat, 11 May 2024 14:29:13 +0000

On this episode of The Cybersecurity Defenders Podcast we take a closer look at the RSA Conference: past, present and future.

The RSA Conference is a series of IT security conferences. Approximately 45,000 people attend one of the conferences each year. It was founded in 1991 as a small cryptography conference. RSA conferences take place in the United States, Europe, Asia, and the United Arab Emirates each year. The conference also hosts educational, professional networking, and awards programs.

#122 - Platformization in cybersecurity with Maxime Lamothe-Brassard, Founder & CEO of LimaCharlie

LimaCharlie — Mon, 06 May 2024 12:00:11 +0000

On this episode of The Cyebrsecurity Defenders Podcast, we talk platformization and the SecOps Cloud Platform with Maxime Lamothe-Brassard, Founder & CEO of LimaCharlie.

In a world where digital transformation has become the norm, cybersecurity professionals face unprecedented challenges. The traditional approach of managing dozens of disparate point solutions and siloed security tools, while attempting to control costs, is no longer sufficient.

It's time to embrace a new era of cybersecurity in the SecOps Cloud Platform – one that treats cybersecurity as a set of capabilities much like how cloud providers did for IT. We challenge you to question the status quo and to open your mind a new way of thinking about security operations.

You can get started for free at limacharlie.io

#121 - Intel Chat: Albatross leak, Cerber ransomware, UAT4356 & MITRE compromised

LimaCharlie — Wed, 01 May 2024 13:59:37 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.
Ukrainian hackers claim to have breached the Russian drone developer Albatross, leaking 100 gigabytes of data, including internal documentation, technical data and drawings of various types of unmanned aerial vehicles.
A critical vulnerability in Atlassian Confluence Data Center and Server was used to deploy a Linux variant of Cerber ransomware.
Cisco Talos are actively monitoring a global increase in brute-force attacks against a variety of targets, including VPN services, web application authentication interfaces and SSH services since at least March 18, 2024.
An emerging threat campaign named ArcaneDoor, orchestrated by a previously unknown actor identified as UAT4356, now also known as STORM-1849 by Microsoft.
The MITRE Corporation reported a significant security breach within one of its specialized networks, the Networked Experimentation, Research, and Virtualization Environment - or NERVE.

#120 - Open Source Intelligence with Mishaal Khan, Cybersecurity Practice Lead at Mindsight

LimaCharlie — Tue, 30 Apr 2024 12:00:10 +0000

In this episode of The Cybersecurity Defenders Podcast, we take a close look at Open Source Intelligence with Mishaal Khan, Cybersecurity Practice Lead at Mindsight.

Misshal is a jack of all trades and master of some! With a profound knack for thinking like the bad guys, Misshal harnesses his extensive knowledge—from the nitty-gritty of bits and bytes to intricate business processes. As a techie, Ethical Hacker, OSINT enthusiast, and Social Engineer, he leverages his diverse skillset to help organizations fortify their defenses and tackle real-world security challenges.

You can find out more about his book, The Phantom CISO, on his website, here.

And you can learn more about Operation Privacy here.

#119 - Special Episode: Sandworm is promoted to APT44

LimaCharlie — Thu, 25 Apr 2024 14:18:39 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss the GRU-backed cyber unit Sandworm which was recently promoted to APT44 by Mandiant.

Sandworm is a notorious hacking group, believed to be linked to Russia's military intelligence agency, the GRU. Known for its destructive cyberattacks, Sandworm has targeted various sectors worldwide, including energy, media, and election systems. Their activities are marked by the use of sophisticated malware and tactics that not only seek to steal information but also to disrupt critical infrastructure. The group gained international prominence with attacks like NotPetya in 2017, which caused billions of dollars in damage across multiple countries, emphasizing their capability to impact global cyber stability.

The name "Sandworm" is inspired by the monstrous creatures from Frank Herbert's science fiction novel "Dune," reflecting the group's elusive and destructive nature. Over the years, Sandworm's operations have evolved, showcasing their adaptability and the increasing complexity of their attacks. This evolution highlights the growing challenges in cybersecurity, making the understanding of such threat actors crucial for developing robust defense strategies against state-sponsored cyber warfare.

YouTube video showing Sandworm attacking a Ukrainian power plant here.

Episode #56 - When the lights went out in Ukraine (Part 1)

Episode #74 - When the lights went out in Ukraine (Part 2)

Episode #16 - NotPetya

#118 - Intel Chat: FakeBat, Sisense, APT29 & CVE of 10

LimaCharlie — Thu, 18 Apr 2024 12:30:07 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

eSentire's Threat Response Unit has observed FakeBat loader being distributed via FakeUpdates, ultimately leading to a LummaC2 infection via a custom-written PaykRunPE provided by the FakeBat Threat Actors.
CISA is investigating a breach at business intelligence company Sisense and urged all Sisense customers to reset any credentials and secrets that may have been shared with the company.
CISA has confirmed that Russian government-backed hackers stole emails from several U.S. federal agencies as a result of an ongoing cyberattack at Microsoft.
Volexity identified a zero-day exploitation of a vulnerability found within the GlobalProtect feature of Palo Alto Networks PAN-OS at one of its network security monitoring customers.

#117 - Digital Forensics with Carlos Cajigas, CTO at Covert Bit

LimaCharlie — Tue, 16 Apr 2024 13:32:39 +0000

In this episode of The Cybersecurity Defenders Podcast, we take a close look at Digital Forensics with Carlos Cajigas, CTO of Covert Bit.

Carlos is a seasoned Incident Response professional hailing from San Juan, Puerto Rico. Carlos's journey in the field began after dedicating over a decade to law enforcement, specializing as a Digital Forensics Detective and Examiner in West Palm Beach, Florida. His extensive experience spans conducting detailed examinations on numerous digital devices, backed by hundreds of hours in specialized training from reputable institutions like EnCase, NW3C, Access Data, and SANS, to name a few. Carlos is not just an expert in the field; he's also a dedicated educator, holding instructor roles with both the Florida Department of Law Enforcement and SANS, where he teaches courses on Windows Forensic Analysis and Advanced Incident Response. With a solid academic foundation, Carlos brings a wealth of knowledge and insight into today's digital forensics and incident response landscape.

You can find Carlos on Twitter/X here.

#116 - Intel Chat: XZ Utils

LimaCharlie — Thu, 04 Apr 2024 07:05:35 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

On March 29, 2024 defenders became aware that a backdoor was intentionally planted inside of XZ Utils an open source data compression utility available on many installations of Linux and other Unix-like operating systems. The threat actors behind this implant likely spent years on this operation and were very close to getting the backdoor merged into Debian and Redhat before it was discovered.

The original disclosure email can be found here.

A technical break down of the compromise can be found here.

A Wired article covering the compromise in-depth can be found here.

#115 - The cyber threat from China, with Adam Kozy & Daniel Velasquez

LimaCharlie — Wed, 03 Apr 2024 07:01:06 +0000

In this episode of The Cybersecurity Defenders Podcast we have an in-depth talk about the cyber threat from China, with Adam Kozy and Daniel Velasquez.

Daniel started his career as a defender in the United States Marine Corps as an intelligence analyst where he served in Afghanistan - from there he went on to work with the Defense Intelligence Agency, Joint Special Operations Command and the CIA. After his service, he was a director at Mandiant and is now the Executive Vice President of OP[4] - a company providing security for critical devices and embedded systems.

Adam began his career as an intelligence analyst working with the Federal Bureau of Investigation where he provided all-source analysis of Asia-Pacifc related cybersecurity issues. After the FBI, Adam was the principal intelligence analyst for the Asia cyber team at CrowdStrike.

Currently, he is the founder of SinaCyber which is a boutique consulting firm combining native Chinese language research and cyber intelligence expertise to create bespoke reports for government officials, technology firms, and financial institutions under threat from China's rampant cyber espionage campaigns.

The history of China and its people goes back to ancient times. It is a rich and beautiful culture that has given much to the world in the form of art, ideas and technology. When we talk about China or the Chinese in this podcast episode we are specifically talking about the Chinese Communist Party - or CCP - which are a group of elites offering an increasingly authoritarian world view and alternative model to Western ideals of democracy and freedom.

The Chinese people themselves are not your enemy. Current laws in China make it easy for the CCP to co-opt its citizenry for use in intelligence operations, wittingly and unwittingly.

Unnecessarily making this into a racial divide alienates the folks that can help us the most in the coming years and provides more ammunition for Beijing.

It was an incredible honor to speak with these two, and I hope you enjoy this conversation full of valuable information.

Adam's testimony before the U.S.-China Economic and Security Review Commission Hearing on, “China’s Cyber Capabilities: Warfare, Espionage, and Implications for the United States” here.

The Mandiant report on APT1 can be found here.

#114 - The tokenization process of payment systems with Salvador Mendoza, Director of Research and Development at Metabase Q

LimaCharlie — Fri, 29 Mar 2024 19:26:25 -0100

In this episode of The Cybersecurity Defenders Podcast we speak with Salvador Mendoza, Director of Research and Development at Metabase Q, about the tokenization of payment systems.

Salvador is a prominent figure in the cybersecurity industry and holds the position of Director of Research and Development at Metabase Q. He is also an integral member of the Ocelot Offensive Security Team. His area of expertise lies in the intricate world of the tokenization process, payment systems, and the development of embedded prototypes. With a commendable history of presenting at high-profile security conferences including Black Hat, DEF CON, Hack in the Box, and Troopers, Salvador brings a wealth of knowledge and insight to our discussion. Furthermore, he is the author of the insightful book, "Show me the e-money. Hacking digital payment systems: NFC, RFID, MST and EMV Chips," where he delves into the vulnerabilities and security measures of digital payment technologies.

You can find his book for purchase here.

And you can find the PCI spec here.

You can follow Salvaador on Twitter/X here.

#113 - Intel Chat: StrelaStealer, APT29, Apple's M-series & APT31

LimaCharlie — Wed, 27 Mar 2024 19:27:11 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Unit 42 have recently identified a wave of large-scale StrelaStealer campaigns impacting over 100 organizations across the EU and U.S.
Researchers at Mandiant on Friday raised an alarm after discovering Russia’s APT29 hacking group targeting political parties in Germany, indicating a possible new operational focus beyond typical attacks on diplomatic figures.
The newly discovered vulnerability baked into Apple’s M-series of chips that allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations.
The Department of Justice this week charged seven Chinese nationals, who are affiliates of threat group APT31, with widespread cyber espionage against US businesses and politicians.

#112 - Cyber Threat Intelligence Networking with Grace Chi, CoFounder & COO of Pulsedive Cyber Threat Intelligence

LimaCharlie — Fri, 22 Mar 2024 13:29:14 -0100

In this episode of The Cybersecurity Defenders Podcast we speak with Grace Chi, CoFounder & COO of Pulsedive Cyber Threat Intelligence about a report she published on cyber threat intelligence networking.

Cyber Threat Intelligence (CTI) is an evolving field, with an industry-wide consensus that teams cannot effectively operate in an intelligence silo. This sentiment is shared across all stakeholder segments – public, private, vendor, and academic. In support of improved CTI sharing, stakeholders have invested in efforts around cross-boundary collaboration, technical standardization, managing trust, and reporting best practices. However, understanding the time and effort spent in CTI networking (i.e. connecting human-to-human for improved business outcomes) is often overlooked.

The report can be found here: Sharing, Compared: A Study on the Changing Landscape of CTI Networking

The Op Ed mentioned in the show: Op-Ed: How tro Make STIX Stickie

And the subreddit mention on the show (possibly NSFW): LinkedIn Lunatics

Pulsedive can be found on Twitter here.

Grace can be found on LinkedIn here.

#111 - Intel Chat: Magnet Goblin, StopCrypt ransomware, aiohttp & Midnight Blizzard

LimaCharlie — Wed, 20 Mar 2024 06:30:09 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Threat actors have been actively targeting vulnerable Connect Secure VPN appliances after the disclosure of CVE-2023-46805 and CVE-2023-21887.

Threat researchers recently observed an interesting variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file encryption code.

In the last week of January 2024, a patch was released to address a directory traversal vulnerability in the package that allows unauthenticated, remote attackers to access sensitive information from arbitrary files on the server if exploited.

On March 8th, Microsoft said that it’s still trying to evict the elite Russian government hackers who broke into the email accounts of senior company executives in November and who it said have been trying to breach customer networks with stolen access data.

#110 - Intel Chat: Lazarus Group, tunnelling with QEMU, ScreenConnect & CISA breach

LimaCharlie — Fri, 15 Mar 2024 12:53:34 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

North Korean threat actors known as the Lazarus Group exploited a zero-day in the Windows AppLocker driver to gain kernel-level access and turn off security tools, allowing them to bypass noisy Bring Your Own Vulnerable Driver techniques.
Researchers observed threat actors run the Angry IP Scanner, followed by some Mimikatz functions, and then the kicker, the open-source QEMU hardware emulator and virtualizer.
Threat actors have been observed installing RMM tools as a means of maintaining persistence within a compromised organization.
Hackers breached some of the systems belonging to CISA in February through some known vulnerabilities in Ivanti products.

#109 - Hacker History: The MOVEit cyberattack

LimaCharlie — Wed, 13 Mar 2024 12:58:37 -0100

In this episode of The Cybersecurity Defenders Podcast, we recount some hacker history, and with the help of John Hammond, Principal Security Researcher at Huntress, tell the story of the MOVEit cyberattack: the biggest data theft of 2023.

The MOVEit cyberbreach, was a far-reaching cyber attack that unfolded with significant implications worldwide. The breach initially came to light on June 3, when the Government of Nova Scotia disclosed that approximately 100,000 of its current and former employees had been affected, signaling the severity of the breach's impact.

The scope of the breach widened on June 5, as it became apparent that numerous organizations in the United Kingdom had also fallen victim. Among those affected were prominent entities such as the BBC, British Airways, Boots, Aer Lingus, and the payroll service provider Zellis. This phase of the breach underscored its indiscriminate nature, with targets spanning across various sectors.

Further developments were reported on June 12, with major organizations like Ernst & Young, Transport for London, and Ofcom announcing their entanglement in the breach. Of particular concern was Ofcom's revelation that personal and confidential information had been compromised, highlighting the breach's capacity to infiltrate and extract sensitive data.

The United States felt the breach's ramifications by June 15, with reports confirming that the Department of Energy, among other federal entities, was impacted by the MOVEit vulnerability. The breach's reach extended further on June 16, affecting state-level organizations such as the Louisiana Office of Motor Vehicles and Oregon Driver and Motor Vehicle Services, thereby impacting millions of American residents.

By October 25, 2023, a report from the cybersecurity firm Emsisoft indicated that the MOVEit cyberbreach had affected over 2,500 organizations globally, with a significant 80% of these being based in the United States. This breach highlights the critical vulnerabilities within digital infrastructures and underscores the urgent need for enhanced security measures to protect against such widespread cyber threats.

This story was written by the talented Nathaniel Nelson and produced by the team at LimaCharlie.

And a special thank you to John Hammond, Principal Security researcher at Huntress, for sharing his expertise and experience

If you have any feedback or ideas for future topics or guests, please send an email to defenders@limacharlie.io.

#108 - Intel Chat: Nood RAT, GTPDOOR, Pikabot, Bifrost & the Executive Order on Preventing Access to Americans

LimaCharlie — Fri, 08 Mar 2024 15:00:36 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

AhnLab Security Intelligence Center published an article exploring Nood RAT. Nood RAT is a variant of Gh0st RAT that works in Linux.
GTPDOOR is the name of Linux-based malware that is intended to be deployed on systems in telco networks adjacent to the GRPS eXchange Network with the novel feature of communicating C2 traffic over GTP-C Control Plane signaling messages.
Researchers reporting on Pikabot evasion techniques for Endpoint Detection and Response systems by employing an advanced technique to hide its malicious activities known as “indirect system calls”.
Nit 42 at Palo Alto Networks, they are reporting on a new Linux variant of Bifrost that is showcasing an innovative technique to evade detection.
President Biden issued an Executive Order to protect Americans’ sensitive personal data from exploitation by countries of concern.

#107 - Weaponizing ASCII escape sequences with Fredrik (STÖK) Alexandersson

LimaCharlie — Wed, 06 Mar 2024 17:56:54 -0100

In this episode of The Cybersecurity Defenders Podcast, we take a close look at weaponizing ASCII escape sequences with Fredrik (STÖK) Alexandersson from Truesec.

Fredrik (STÖK) Alexandersson is a dynamic individual driven by a boundless curiosity and a passion for sharing knowledge. With over three decades of professional experience, he's hacked his way through realms ranging from computers and technology to marketing, fashion, communication, and even the human psyche. Renowned for his lightning-fast presentations and his knack for making complex technical subjects entertaining, STÖK is a prominent figure in the cybersecurity community. His meticulous attention to detail, insatiable curiosity, and "Good Vibes Only" attitude have inspired millions worldwide and earned him recognition from industry giants like Salesforce, Microsoft, and Verizon Media, among many others. Currently, he working as a Hacker and Creative Director at TRUESEC.

You can follow him on Twitter/X here.

And you can watch his talk on Weaponizing ASCII escape sequences here.

#106 - Intel Chat: LockBit, TicTacToe Dropper, Google Cloud Run & I-Soon

LimaCharlie — Thu, 29 Feb 2024 07:00:00 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Law enforcement from 10 countries - in a joint operation called ‘Operation Cronos’ - have disrupted the criminal operation of the LockBit ransomware group.
FortiGuard has identified a grouping of malware droppers used to deliver various final-stage payloads through 2023 they are calling the TicTacToe dropper.
Cisco Talos researchers have observed a significant increase in the volume of malicious emails leveraging the Google Cloud Run service to infect potential victims with banking trojans.
A massive leak from a Chinese Ministry of Public Security contractor called I-Soon shows that Bejing’s intelligence and military groups are attempting large-scale, systemic cyber intrusions against foreign governments, companies, and infrastructure.

#105 - Cybersecurity in space systems with Tim Fowler, Offensive Security Analyst at Black Hills Information Security

LimaCharlie — Wed, 28 Feb 2024 07:00:11 -0100

In this episode of The Cybersecurity Defenders Podcast, we talk about cybersecurity issues as they relate to the space industry with Tim Fowler, Offensive Security Analyst at Black Hills Information Security.

Tim's unique blend of curiosity, determination, and passion for problem-solving make him stand out in the cybersecurity world. As a frequent speaker on topics ranging from Information Security to Open Source software, Tim's mission is clear: to empower others to take control of their journey and make a positive impact in the world of cybersecurity.

Currently Tim is working as an offensive security analyst for Black Hills Information Security - and he is here today to talk to use about the research he has been doing around cybersecurity in space…. and yes, it is as awesome as it sounds.

Tim’s upcoming training: Introduction to Cybersecurity in Space Systems

Resources mentioned in the show:

#104 - Intel Chat: Pikabot, OpenAI boots APTs, GRU Military Unit 26165 & the Akira ransomware group

LimaCharlie — Fri, 23 Feb 2024 06:36:33 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

ZScaler ThreatLabz are reporting on some recent campaigns, which started in February 2024, where they observed Pikabot reemerging with significant changes in its code base and structure.
OpenAi is claiming that they have terminated accounts associated with state-affiliated threat actors.
A January 2024 court-authorized operation has neutralized a network of hundreds of small office/home office (SOHO) routers that were used to commit crimes by the GRU Military Unit 26165.
SecurityWeek is reporting on the fine folks at CISA who are urging the patching of a Cisco ASA flaw that is being used in ransomware.

A document naming APT groups and operations can be found here.

#103 - A better way forward for cybersecurity with Maxime Lamothe-Brassard, Founder & CEO of LimaCharlie

LimaCharlie — Wed, 21 Feb 2024 14:36:46 -0100

In this episode of The Cybersecurity Defenders Podcast, we delve into an innovative, engineering-centered perspective on cybersecurity with Maxime Lamothe-Brassard, the Founder & CEO of LimaCharlie.

As part of the Canadian Intelligence apparatus, Maxime worked in positions ranging from development of cyber defence technologies, Counter Computer Network Exploitation, and Counter Intelligence. Maxime led the creation of an advanced cyber security program for the Canadian government and received several Director’s awards for his service.

After leaving the government, Maxime provided direct help to private and public organizations in matters of cyber defence and worked for Crowdstrike, Google and Google X. Maxime left Google X - where he was a founding member of Chronicle Security - in 2018 to found LimaCharlie.

#102 - Intel Chat: toothbrush DDOS, TPM-based encryption bypass & HijackLoader

LimaCharlie — Thu, 15 Feb 2024 22:55:02 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The spectacular headline announcing a DDOS attack that involved 3-million electric toothbrushes.
A hardware attack to bypass TPM-based encryption which is used on most Microsoft Windows devices.
CrowdStrike researchers have identified a HijackLoader sample that employs sophisticated evasion techniques to enhance the complexity of the threat.

#101 - WiFi attacks and defense with Lennart Koopmann, Founder of the Nzyme Network Defense System

LimaCharlie — Tue, 13 Feb 2024 07:20:48 -0100

In this episode of The Cybersecurity Defenders Podcast, we take a close look at WiFi attack methods, and the defenses to them, with Lennart Koopmann, Founder of the Nzyme Network Defense System.

Lennart Koopman, a tech enthusiast originally from Germany, now calling Houston, TX home. He began coding at a young age and chose to forgo formal education, diving straight into the world of computers after high school.

Lennart's career path led him through various roles, from assisting in a hospital's IT helpdesk to web development and eventually joining a startup. In 2009, he launched the Graylog log management system as a side project, marking his entry into the tech scene.

Currently, Lennart is focused on his latest endeavor: The nzyme Network Defense System, demonstrating his ongoing commitment to technological advancement.

The WiFiPhisher Github account can be found here.

Lennart’s talk at MSS CTRL (LINK) can be found here.

The Nzyme Network Defense System website can be found here.

Lennart can be found in Twitter/X here.

#100 - A tale of two breaches: examining the AnyDesk & Cloudflare incidents

LimaCharlie — Fri, 09 Feb 2024 08:00:37 -0100

In this episode of The Cybersecurity Defenders Podcast, we take a close look at the AnyDesk and Cloudflare breaches that were both disclosed on February 2, 2024.

AnyDesk, a prominent remote desktop software provider, disclosed a cyberattack late on February 2nd, causing the company to enforce strict security measures for nearly a week. Adversaries breached AnyDesk's systems, compromising vital assets such as source code and private code signing keys, and gaining unauthorized access to production systems.

For more on AnyDesk's breach, see the following references:

https://techcrunch.com/2024/02/05/remote-access-giant-anydesk-resets-passwords-and-revokes-certificates-after-hack/

https://anydesk.com/en/public-statement

https://www.infosecurity-magazine.com/news/anydesk-hit-cyberattack-customer/

https://www.helpnetsecurity.com/2024/02/05/anydesk-hacked/

https://thehackernews.com/2024/02/anydesk-hacked-popular-remote-desktop.html

On the other front, Cloudflare disclosed that a nation-state actor infiltrated their self-hosted Atlassian server on November 14, 2023, utilizing stolen access tokens and service account credentials from the Okta breach. The threat actor conducted reconnaissance activities from November 14th to 17th, gaining access to Cloudflare's internal wiki and bug database. Additional access attempts on November 20th and 21st indicated the actor's persistence, culminating in establishing continuous access through ScriptRunner for Jira on November 22nd. Finally, they tried, unsuccessfully, to access a console server that had access to a data center that Cloudflare had not yet put into production in São Paulo, Brazil.

For more details on Cloudflare's breach, consult the following sources:

https://www.csoonline.com/article/1303785/nation-state-actor-used-recent-okta-compromises-to-hack-into-cloudflare-systems.html

https://www.techtarget.com/searchsecurity/news/366568694/Cloudflare-discloses-breach-related-to-stolen-Okta-data

https://www.computing.co.uk/news/4170126/cloudflare-server-breached-suspected-sponsored-threat-actors

#99 - Ground truth realities with Yochai Greenberg, Frontline Cyber Defender

LimaCharlie — Tue, 06 Feb 2024 13:10:46 -0100

In this episode of The Cybersecurity Defenders Podcast, we delve into the ground truth realities of cybersecurity with Yochai Greenberg, a frontline cyber defender.

Yochai Greenberg's expertise in cybersecurity is grounded in a lifetime of hands-on experience and military service. From an early age, he immersed himself in computer technology, gaining comprehensive knowledge of hardware and software through practical experimentation. Serving in the IDF further cultivated his understanding of protection and security protocols.

Transitioning into the security industry, Yochai applied his diverse skill set as an executive protection professional, bridging the gap between physical and digital security domains. His career is defined by a relentless pursuit of knowledge and innovation, driven by a commitment to integrating and enhancing security measures across various fronts.

#98 - Intel Chat: Midnight Blizzard, GKE vulnerability, NetSupport RAT & Cactus ransomware

LimaCharlie — Thu, 01 Feb 2024 19:31:03 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Microsoft updated the public on their findings - apparently, the threat actors were able to gain persistent access to the privileged email accounts by abusing the OAuth authorization protocol.
Cybersecurity researchers have discovered a loophole impacting Google Kubernetes Engine that could be potentially exploited by threat actors to take control of a Kubernetes cluster.
A new campaign is using phishing emails to distribute malware and legitimate services to bypass email protection systems to install NetSupport RAT.
On January 20th the Cactus ransomware group attacked a number of victims across varying industries.

#97 - Cybersecurity threats to electric vehicles with Mike Pedrick, VP of Cybersecurity Consulting at Nuspire

LimaCharlie — Tue, 30 Jan 2024 14:50:59 -0100

On this episode of The Cybersecurity Defenders Podcast, we discuss some of the cybersecurity threats to electric vehicles with Mike Pedrick, VP of Cybersecurity Consulting at Nuspire.

Mike is currently serving as the Vice President of Cybersecurity Consulting at Nuspire. In his role over the past two years, Mike has focused on providing advisory services to mid-market clients in the areas of cybersecurity, governance, risk, and compliance with data security and privacy standards. His specialization lies in implementing mature cybersecurity programs tailored for small and medium-sized businesses. Mike is also actively involved with ISACA, where he currently serves as the Certification Coordinator for the Denver Chapter Board, managing certification-related activities.

Before joining Nuspire, Mike held positions such as Vice President of Consulting at Stealth - ISS Group Inc. and Director of Security Consulting at Synoptek. In these roles, he provided leadership and advisory services in the cybersecurity domain. With over a decade of self-employment as a Security, Compliance, and Risk Management Consultant, Mike has served as a trusted advisor to SMB/Midmarket organizations, offering guidance in cybersecurity, compliance, and risk management.

#96 - Intel Chat: iOS malware detection, credentials leaked, ColdRiver, & Midnight Blizzard

LimaCharlie — Thu, 25 Jan 2024 14:07:26 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

SecureList researchers from Kaspersky have come up with a lightweight method to detect iOS malware.
Nearly 71 million unique credentials that were leaked from websites such as Facebook, Roblox, eBay, Yahoo, and Coinbase have been circulating on the Internet.
Russian threat group COLDRIVER has expanded its targeting of Western officials to include the use of malware.
The Microsoft security team is reporting that it detected a nation-state attack on its corporate systems on January 12, 2024.

#95 - The SaaS Cyber Kill Chain with Luke Jennings, VP Research & Development at Push Security

LimaCharlie — Tue, 23 Jan 2024 13:54:00 -0100

On this episode of The Cybersecurity Defenders Podcast, we have a conversation about the SaaS Cyber Kill Chain with Luke Jennings, VP of Research & Development at Push Security.

In this interview, we explore the evolution of cyber attacks and the impact of the remote working and SaaS revolution on the cyber kill chain.

The SaaS Attack Matrix can be found here.

#94 - Intel Chat: Bandook, NoaBot, mandating 2FA & POST SMTP

LimaCharlie — Fri, 19 Jan 2024 07:42:49 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A new Bandook variant has been distributed via a PDF since this past October.
Akami researchers have uncovered a new crypto-mining campaign that has been active since the start of 2023.
The Centres for Medicare and Medicaid Services will reportedly set out the proposed requirements that include two-factor authentication and maintaining a vulnerability-fixing program.
Two vulnerabilities were uncovered that impact the POST SMTP Mailer WordPress plugin, an email delivery tool used by 300,000 websites.

#93 - Poisoning Github's runner images with Adnan Khan, Lead Security Engineer at Praetorian

LimaCharlie — Tue, 16 Jan 2024 15:03:58 -0100

On this episode of The Cybersecurity Defenders Podcast we speak with Adnan Khan, Lead Security Engineer at Praetorian, about a supply chain attack that was successful in poisoning Gihub’s runner images.

Adnan is an Offensive Security Engineer and Security Researcher with a strong development background and passion for CI/CD and supply chain security.

Adnan’s research can be found here.

The Github Attack TOolkit can be found here.

And Adnan can be found on LinkedIn here.

#92 - Early cybersecurity career advice with Gerald Auger, Chief Content Creator at Simply Cyber

LimaCharlie — Fri, 12 Jan 2024 14:38:57 -0100

On today's episode of The Cybersecurity Defenders Podcast, we chat with Gerald Auger, Chief Content Creator at Simply Cyber.

Dr. Gerald Auger is deeply passionate about information security, holding a steadfast belief that there exists a bespoke information security program for every organization. This tailored approach, he contends, not only mitigates cybersecurity risks but also amplifies overall value, aligning harmoniously with the business mission. Through Coastal Information Security Group, Dr. Auger extends his consulting and advisory cybersecurity services to both large and small organizations. With a focus on guiding the implementation of robust information security programs, he strives to meet the unique needs of each client.

Gerald Auger's, 'Build an Elastic SIEM lab' video

Eric Capuano's, 'So you want to be a SOC Analyst?' Part 1 & Part 2

You can find Gerald on the various social media platforms as linked below.

YouTube

Twitter

#91 - Intel Chat: ALPHV, DanaBot?, Operation Triangulation, npm everything, & Sandworm?

LimaCharlie — Wed, 10 Jan 2024 14:14:30 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

An international group of law enforcement agencies has seized the dark web leak site of the notorious ransomware gang known as ALPHV, or BlackCat.
IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections with a possible connection to DanaBot.
Kaspersky published some new research in which they have identified a vulnerability in Apple System on a chip - or SOC - that has played a critical role in the attacks they saw in Operation Triangulation.
NPM package “everything” downloads millions of packages and prevents all authors on npmjs.com from removing their packages.
Russian hackers were inside the Ukrainian telecom giant Kyivstar's system from at least May last year and recently caused a destructive outage.

And the Hacker History episodes, When the Lights Went Out in Ukraine Part 1 & Part 2.

#90 - The similarities between punk rock and cybersecurity with James McMurry, Founder & CEO of ThreatHunter.ai

LimaCharlie — Fri, 05 Jan 2024 15:01:06 -0100

On this episode of The Cybersecurity Defenders Podcast, we have a conversation with James McMurry, Founder and CEO of ThreatHunter.ai.

James is a cybersecurity veteran (and a veteran) with a career that spans over 30 years.

He's the problem-solver who sees complexity as a puzzle to unravel.

His approach goes beyond buzzwords; James transforms innovation into reality by blending AI, machine learning, and a team of human threat hunters into an effective cybersecurity strategy.

Beyond the office, James is a discerning whisk(e)y enthusiast, showcasing a refined taste that matches his coding finesse. He is also a philanthropist and the Founder of VETCON.

James can be found on Twitter here.

And on Instagram here.

#89 - Hard-won entrepreneurial lessons with JP Bourget, Founder and President of Blue Cycle

LimaCharlie — Wed, 03 Jan 2024 15:56:22 -0100

On this episode of The Cybersecurity Defenders Podcast, we have a conversation with JP Bourget, Founder and President of Blue Cycle, who shares some hard-won lessons from his entrepreneurial journey.

JP Bourget specializes in empowering Blue Teams and Security Operations Centers (SOCs) by implementing cutting-edge methodologies to enhance Cyber Maturity. His expertise spans automation, data engineering, API integration, and advocating security-as-code principles. Additionally, he holds the role of Entrepreneur in Residence (EIR) at Lytical Ventures.

Previously, JP was the Founder and Chief Security Officer (CSO) of Syncurity, a company acquired by Swimlane and an early pioneer in the Security Orchestration, Automation, and Response (SOAR) landscape. Syncurity's flagship product, IR-Flow, revolutionized alert triage, allowing organizations to optimize their security efforts efficiently.

Before co-founding Syncurity, JP honed his skills as the Network Security Manager at Arnold Magnetic Technologies, a prominent global manufacturing enterprise valued at $250 million.

JP can be found on LinkedIn here.

Podcast trailer for 2024

LimaCharlie — Tue, 02 Jan 2024 14:58:57 -0100

Welcome to the Cybersecurity Defenders Podcast. My name is Christopher Luft, one of the founders of LimaCharlie and I am your host.

This podcast is set up as a series of segments in and around cybersecurity - with a focus on the defensive side.

Tune in for weekly intelligence reports and discussions, as well as deep-dives into major incidents like the MGM ransomware attack or the recent Okta breach with expert guests who can break down the events.
I also get the privilege of interviewing many information security experts to share their unique stories. Hear from security analysts, detection engineers, CISOs, and other high-profile public figures.
And my personal favourite, is a special segment called Hacker History where we narrate the true stories of infamous cybersecurity incidents with the help from those that were directly involved.

The show is a constant work in progress and we would love for you to join us. We are always happy to hear from our listeners and encourage you to engage with us so that we can make this show the best it can be. So subscribe and follow along as we learn and grow together in this ever-evolving realm of cybersecurity.

#88 - Predictions for the future of cybersecurity from 2023

LimaCharlie — Sun, 31 Dec 2023 19:30:07 -0100

A special episode of The Cybersecurity Defenders Podcast, where we look back at our conversations throughout 2023, and bring together all of the predictions for the future of cybersecurity.

It is a fun episode, and we hope you enjoy listening to it.

And a Happy New Year to all our listeners! Wishing you security and success in 2024.

#87 - Hacker History: The Colonial Pipeline

LimaCharlie — Thu, 28 Dec 2023 14:08:25 -0100

This episode was written by the talented Nathaniel Nelson.

Casey Ellis can be found on LinkedIn here.

#86 - Intel Chat: pfSense vulnerability, Gootloader, OilRig & the KV-botnet

LimaCharlie — Wed, 20 Dec 2023 22:44:30 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Sonar Source are reporting on a few vulnerabilities they have found in pfSense.
eSentire’s Threat Response Unit launched a multi-pronged offensive against the Gootloader Initial Access-as-a-Service Operation.
ESET researchers documented a series of new OilRig downloaders, all relying on legitimate cloud service providers for command and control communications.
The Black Lotus Labs team at Lumen Technologies is tracking a small or home office router botnet that forms a covert data transfer network for advanced threat actors.

You can make a donation in support of ending domestic violence through Cybersecurity Cares.

#85 - Going deep on Active Directory with James Potter, founder of DSE

LimaCharlie — Thu, 14 Dec 2023 14:49:48 -0100

On this episode of The Cybersecurity Defenders Podcast, we have a detailed conversation with James Potter, founder of DSE, about Active Directory.

James boasts over two decades of expertise in Active Directory security, serving as a trusted consultant for major companies. His focus is on fortifying security measures and devising strategies to strengthen critical systems. He's collaborated with diverse teams, identifying vulnerabilities and implementing robust security measures while balancing cost, usability, and security for each client's specific needs.

Beyond consultancy, James proudly leads a team at DSE, providing cutting-edge security solutions to global corporations. Actively engaging in the security community, he shares insights through conferences, publications, and forums, emphasizing continuous learning and innovation to counter evolving threats.

His passion lies in aiding organizations to navigate the dynamic threat landscape, ensuring resilient security frameworks and efficient business objectives. Whether crafting secure Active Directory environments, conducting assessments, or delivering tailored training, James's dedication ensures exceptional results surpassing client expectations.

James can be found on LinkedIn here: James Potter

#84 - Intel Chat: Push notification surveillance, a RAT, a critical Bluetooth flaw & 5Ghoul

LimaCharlie — Wed, 13 Dec 2023 22:56:41 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Unidentified governments are surveilling smartphone users via their apps' push notifications, as reported by a US senator on December 6th.
Cyber.wtf reporting on an interesting piece of malware that turned out to be a RAT written in C#.
Israel’s critical infrastructure is under threat from an Iranian proxy hacking group operating out of Lebanon.
Hacker News is reporting on a critical Bluetooth security flaw that could be exploited by threat actors to take control of Android, Linux, MacOS and iOS devices.
A collection of security flaws in the firmware implementation of 5G mobile network modems from major chipset vendors such as MediaTek and Qualcomm impact USB and IoT modems as well as hundreds of smartphone models running Android and iOS.

The Cybersecurity Cares Holiday Telethon is taking place on December 15th. More information can be found at cybersecurity-cares.com

#83 - Intel Chat: Atomic Stealer, Okta breach grows, CrushFTP & Danabot opens the door for Cactus ransomware

LimaCharlie — Fri, 08 Dec 2023 10:11:38 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

MalwareBytes is reporting on Atomic Stealer, a popular information stealer for MacOS.
Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system.
Huntress is reporting that threat actors of varying types continue to target managed file transfer applications for exploitation.
Microsoft has detected Danabot infections leading to hands-on-keyboard activity by ransomware operator Twisted Spider, culminating in the deployment of Cactus ransomware.

#82 - Decrypting Darknet Diaries: A Conversation with Jack Rhysider

LimaCharlie — Thu, 07 Dec 2023 12:00:11 -0100

On this episode of The Cybersecurity Defenders Podcast, we speak with Jack Rhysider, the creator of Darknet Diaries.

Darknet Diaries is a captivating podcast that delves into the intriguing and often clandestine world of cybersecurity and hacking. Hosted by Jack Rhysider, each episode features gripping narratives that explore real-life cybercrime incidents, hacking escapades, security breaches, and the individuals involved. Rhysider skillfully combines storytelling with in-depth interviews, providing a unique and engaging perspective on the complex landscape of cybersecurity. The podcast not only highlights the darker aspects of the internet but also sheds light on the efforts of cybersecurity professionals, their challenges, and the measures taken to defend against cyber threats. With its compelling storytelling and insightful discussions, Darknet Diaries offers a fascinating glimpse into the ever-evolving world of digital security.

Learn more about the show, purchase swag, and listen to episodes at https://darknetdiaries.com/

You can find Jack Rhysider on Twitter/X here: @JackRhysider

#81 - Intel Chat: DarkCasino, Agent Tesla, DarkGate, DiamonSleet & Chimera

LimaCharlie — Thu, 30 Nov 2023 15:06:50 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

NSFOCUS Research Labs about how the DarkCasino APT group has leveraged a recently disclosed WinRAR zero-day vulnerability.
G DATA CyberDefense is reporting on a threat actor using the ZPAQ archive and .wav file extension to infect systems with Agent Tesla.
A technical analysis of DarkGate Malware-as-a-Service which is widely available on various cybercrime forums by the RastaFarEye persona.
The Micrososft Threat Intelligence team has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet involving a malicious variant of an application developed by CyberLink Corp.
The Chinese hacker group “Chimera” broke into NXP - a Dutch chip maker - at the end of 2017 and had access to the manufacturer’s systems until the spring of 2020.

To learn more about the community initiative to help end domestic violence please visit cybersecurity-cares.com

#80 - A look into the cybercriminal underworld with Jon DiMaggio, Chief Security Strategist at Analyst1

LimaCharlie — Wed, 29 Nov 2023 15:43:30 -0100

On this episode of The Cybersecurity Defenders Podcast we take a look into the cybercriminal underworld with Jon DiMaggio, Chief Security Strategist at Analyst1.

Jon DiMaggio is the chief security strategist at Analyst1 and has over 15 years of experience hunting, researching, and writing about advanced cyber threats. As a specialist in enterprise ransomware attacks and nation-state intrusions, such as”Ransom Mafia:Analysis of the World’s first Ransomware Cartel”,“Nation State Ransomware” and a “History of REvil”. He has exposed the criminal cartels behind major ransomware attacks, aided law enforcement agencies in federal indictments of nation-state attacks, and discussed his work with The New York Times, Bloomberg, Fox, CNN, Reuters, and Wired. You can find Jon speaking about his research at conferences such as RSA. Additionally, in 2022, Jon authored the book “The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime” published by No Starch Press.

You can buy “The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime” here.

The Ransomware Diaries: Volume1 & Volume2

Jon DiMaggio on LinkedIn

Jon DiMaggio on Twitter

#79 - Intel Chat: SystemBC, Ddostf DDOS bot, ALPHV files with the SEC, & LummaC2 v4.0

LimaCharlie — Thu, 23 Nov 2023 14:40:43 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A look at a versatile piece of malware that gets categorised as proxy malware, a bot, a backdoor, and even as a RAT, known as SystemBC.
The AhnLab Security Emergency response Center’s analysis team has published an article outlining their recent discovery that the Ddostf DDoS bot is being installed on vulnerable MySQL servers.
The notorious ALPHV ransomware group has taken extortion to a new level by filing a U.S. Securities and Exchange Commission complaint against one of their alleged victims for not complying with the four-day rule to disclose a cyberattack.
A new Anti-Sandbox technique LummaC2 v4.0 stealer is using to avoid detonation if no human mouse activity is detected, along with some other techniques being employed such as Control Flow Flattening.

And you can sign up to participate in the Defender Fridays series here. Join us as we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

#78 - Brand and marketing for cybersecurity startups with Chris Cochran, VP & Head of Marketing at AKA Identity

LimaCharlie — Tue, 21 Nov 2023 15:47:12 -0100

On this episode of The Cybersecurity Defenders Podcast, we talk with Chris Cochran, VP & Head of Marketing at AKA Identity, about brand and marketing for cybersecurity startups.

Chris Cochran is an entrepreneur who combines a wealth of experience in technology and innate creativity that has proven to be invaluable to both brands and individuals who work with him. As the Co-Founder and CEO of Hacker Valley Media, Chris has a unique perspective on how to craft compelling narratives that engage, inform, and entertain technical audiences. His experience in technology allows him to bring a rare depth of knowledge to any creative project, and his ability to communicate complex ideas equally clearly and entertainingly makes for a powerful combination for reaching everyone, from students to entrepreneurs.

As a US Marine veteran and former cybersecurity professional, Chris has been an intelligence analyst, incident responder, SOC analyst, threat intelligence leader, and security operations leader. On the creative side, Chris has been an award-winning podcaster, TV series showrunner, short film director, keynote speaker, event host, and writer. He is passionate about inspiring and empowering people to live out their personal and professional legend.

With his unique combination of industry knowledge and creative skills, Chris can connect with audiences in an authentic and relatable way, inspiring trust and loyalty, which are crucial elements to building a successful brand, whether personal or corporate. He has created many award-winning shows, including Hacker Valley Studio and Technically Divided, alongside his co-founder Ron Eddings; he is a highly sought-after keynote speaker in technology and helps technology brands stand out from the rest through impactful storytelling.

If you have a story to tell, an experience to create, or a community to reach, Chris can help.

#77 - Intel Chat: Okta again, MuddyWater, Google Calendar Rat & BiBi-Windows Wiper

LimaCharlie — Thu, 16 Nov 2023 07:02:20 -0100

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Arstechnica is reporting that identity and authentication management provider Okta has been hit by another breach.
Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” group.
Google is warning of multiple threat actors sharing a public proof-of-concept exploit that leverages its Calendar service to host command-and-control infrastructure.
BlackBerry Research and Intelligence Team has found a wiper variant that targets Windows systems being deployed by hacktivists in support of Hamas.

#76 - Reimagining the cyber kill chain with David Burkett

LimaCharlie — Wed, 15 Nov 2023 14:46:34 -0100

On this episode of The Cybersecurity Defenders Podcast, we talk with David Burkett, founder of Signalblur, about reimagining the cyber kill chain from a defenders perspective.

David is a dedicated and highly experienced Cloud Detection Engineer and Security Architect, with a proven track record of building three different Cyber Security Operations Centers for multiple MSSP/MDR providers. His expertise is backed by a strong set of GIAC certifications, including GCTI, GCIA, GPYC, and GCED... among others. David is proud to have been part of a security team that won the prestigious James S. Cogswell Outstanding Industrial Security Achievement Award from the Defense Counterintelligence and Security Agency. David is constantly seeking opportunities to grow and learn and is eager to connect with like-minded professionals in the cybersecurity domain.

#75 - A close look at Okta's latest security breach

LimaCharlie — Thu, 02 Nov 2023 06:04:35 -0100

The Cybersecurity Defender's host, Christopher Luft, along with special guest Eric Capuano, walk through the available details of the most recent Okta security breach that affected 1Password, BeyondTrust, and CloudFlare.

On Friday, October 20th, Okta announced that it suffered an intrusion in its customer support system. The company confirmed that 'certain Okta customers' were affected and stated that it notified 'around 1 percent' of its 18,400 customers that they were impacted.

#74 - Hacker History: When the Lights Went Out in Ukraine (Part 2)

LimaCharlie — Mon, 30 Oct 2023 15:20:25 -0100

On this episode of The Cybersecurity Defenders Podcast, we share the second part of 'When the Lights Went Out in Ukraine.'

If you haven’t already, I recommend going back now and listening to “When the Lights Went Out in Ukraine, Part 1.”

This episode was written by the talented Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

And a special thank you to Robert Lipovsky for sharing his first-hand knowledge.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#73 - Intel Chat: macOS malware, BlackCat's Munchkin, Cisco zero-day, the Phantom Hacker, & a WinRAR vuln.

LimaCharlie — Wed, 25 Oct 2023 18:27:31 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Sentinel One talking about emerging trends and evolving techniques for macOS malware in 2023
BlackCat operators recently announced new updates to their tooling, including a utility called Munchkin
On October 16, Cisco released an advisory regarding a critical zero-day privilege escalation vulnerability in their IOS XE Web UI software.
WithSecure Labs is reporting that Vietnamese cybercrime groups are using multiple different Malware as a Service infostealers and Remote Access Trojans to target the digital marketing sector.
The FBI in Phoenix is warning the public of a new scam dubbed “The Phantom Hacker.”
Google’s Threat Analysis Group has recently observed multiple government-backed hacking groups exploiting the known vulnerability, CVE-2023-38831.

#72 - LOLDrivers & Sigma community-based detections with Nas Bencherchali, Detection Engineer & Threat Researcher at Nextron Systems

LimaCharlie — Fri, 20 Oct 2023 16:39:54 +0000

On today’s episode, we going to be speaking with Nas Bencherchall, one of the community members behind the scenes of LOLDrivers and Sigma.

Nas is an avid learner who is passionate about all things detection, malware, DFIR, threat hunting, and Windows Internals.

Nas is one of the community members behind LOLDrivers and one of the maintainers of the SIGMA Rule Repository.

The newly re-imagined Sigma project website can be found here: SigmaHQ

The LoLDrivers website can be found here: LOLDrivers

The VS Code extension we talked about on the show can be found here: VSCOde Ext

Nas on Twitter: nas_bench

Nas’ Blog: nasbench

#71 - Intel Chat: BlackTech, Lazarus, CL0P, Python supply chain, Android malware & libcue 0-day

LimaCharlie — Wed, 18 Oct 2023 07:20:48 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A joint advisory that was published by the NSA, the FBI and CISA, along with, the Japan National Police Agency and the Japan National Center of Incident Readiness and Strategy for Cybersecurity.
ESET researchers have uncovered a Lazarus attack against an aerospace company in Spain.
Unit 42 at Palo Alto are reporting that the CL0P ransomware group recently began using torrents to distribute victim data after a rather notorious campaign stealing data from thousands of companies.
Checkmarx is reporting on a persistent open-source supply chain attacker targeting the Python ecosystem who has been active and evolving since April 2023.
Arstechnica is reporting the discovery of thousands of Androids devices infected with malware right out of the box.
Github Security Lab, in coordination with Ilya Lipnitskiy, has disclosed a 0-day memory corruption vulnerability in libcue, noted as CVE-2023-43641.
Checkmarx reporting on a targeted campaign that unfolded via Pypi, targeting developers utilizing Alibaba cloud services, AWS, and Telegram.

#70 - Navigating a career in cybersecurity with Sean Higgins, Co-founder of the Herjavec Group

LimaCharlie — Fri, 13 Oct 2023 18:12:32 +0000

In this episode of The Cybersecurity Defenders Podcast, we speak with Sean Higgins, consultant, educator, and co-founder of the Herjavec Group.

Sean Higgins is a coach, speaker, author, and consultant with a specialization in cybersecurity program evaluation. With over 35 years of experience in information technology, he has dedicated nearly three decades to the field of cybersecurity. From 2003 to 2022, Sean served as the CTO and Co-founder of Herjavec Group. In his Canadian Best Selling book, "Driven," Robert Herjavec described Sean as "the smartest guy I ever met," a recognition that deeply touched him.

Today, organizations seek out Sean's expertise when they require guidance on resolving technical issues, evaluating technological solutions, or need assistance in shaping the direction of their company's security program. One of his notable strengths lies in helping Chief Information Security Officers (CISO) and senior management confidently evaluate and refine their security programs.

Sean is astounded by the rapid evolution of technology over the years. His career commenced in 1986 when he was writing programs to count light bulbs at General Electric. A few years later, he was instrumental in establishing the first computer network for the North York Public Library in Ontario, an endeavor that predates the widespread internet we know today. During those early days of the ARPANET, Sean used it to send emails to friends still at Purdue University. He also holds the distinction of being the first expert witness in a Canadian court regarding a cybersecurity incident.

Passionate about mentoring millennials in the tech industry to find balance between their professional and personal lives, Sean collaborates with various universities, including the University of York's Career Mentorship Program. Additionally, he is a member of the Case Alumni Association Scholarship Committee, where he has the honor of awarding millions of dollars in scholarships to junior and senior STEM students.

Sean's coaching approach combines elements of traditional life coaching, entrepreneurial business experience, and his ability to read energy. He has received training from the Quantum Success Coaching Academy, Enwaken Coaching, and Enwaken Apprentice programs.

Notably, Sean has self-published his first book on Amazon titled "Living Your Purposeful Life" and is currently working on his second book, "Balancing: How tech managers can avoid burnout, balance priorities, and come back to life," slated for release in January 2023.

Residing on picturesque Vancouver Island, Sean enjoys exploring the island's beauty with his faithful Golden Retriever, Rosie. He is an avid mountain biker and has recently discovered a passion for pickleball. His love for college athletics, particularly college basketball, is evident, and he especially cherishes watching his alma mater, Purdue University, during March Madness. So, reaching him during that time might prove a challenge, as he's likely to be glued to the games.

#69 - The SecOps Cloud Platform for Managed Security Service Providers

LimaCharlie — Tue, 10 Oct 2023 15:15:42 +0000

On this episode of the Cybersecurity Defenders Podcast, a hosted panel discussion with industry leaders to explore what advantages the SecOps Cloud Platform confers for Managed Security Service Providers.

The panel is moderated by LimaCharlie Co-founder, Christopher Luft. The panel participants are:

Co-founder at Soteria, Paul Ihme

Co-founder/CTO at Horangi Security, Lee Sult

What is the SecOps Cloud Platform?

The SecOps Cloud Platform is a construct for delivering the core components needed to secure and monitor any given organization: things like, deploying endpoint capabilities through a single agent regardless of the technology, alerting and correlating from logs regardless of the source, automating analysis and response regardless of the environment.

The SecOps Cloud Platform is:

An environment fundamentally open through APIs, documentation, integrability, affordability; making it a neutral space for all cybersecurity professionals, whether they’re in enterprise, services or vendors to build appropriate solutions.

#68 - Intel Chat: Bumbebee, LockBit Gang, LUC-3, HTTPSnoop, DeadGlyph & Stately Taurus + Alloy Taurus + Gelsemium

LimaCharlie — Thu, 28 Sep 2023 13:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Intel471 are reporting on a campaign utilizing Bumblebee, a type of a loader that has increasingly been used by threat actors affiliated with ransomware.
ESentire are reporting on several attacks conducted by the Russia-linked LockBit Gang.
Permiso reporting on LUC-3 who overlaps with Scattered Spider.
Cisco Talos has discovered a new malware family they have dubbed HTTPSnoop being deployed against telecommunication providers in the Middle East.
WeLiveSecurity have stumbled upon a previously unknown backdoor being deployed in the Middle East that they have named DeadGlyph.
Unit42 have started investigating a series of espionage attacks targeting a government in Southeast Asia.

LimaCharlie's Office Hours, where we break down some TTPs in-depth, take place every Friday at 9.00 AM PT / 12.00 PM ET. You can find more information here: limacharlie.io/office-hours

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#67 - A close look at the MGM cyberattack

LimaCharlie — Fri, 22 Sep 2023 06:00:00 +0000

On the special episode of The Cybersecurity Defenders Podcast we take a close look at the MGM cyberattack that took place in September 2023. On September 11 numerous MGM Resorts International properties in Las Vegas and throughout the United States were attacked by ransomware which shut down many aspects of its IT. Checking in and out, reservations, digital room keys, tickets, credit card systems, some slot machines, and even elevators at several MGM casino hotels became inoperative, forcing their staffs to use manual methods to serve their clientele, i.e. analog pen and paper. MGM filed a Form 8-K report with the SEC the next day. The relatively recent criminal hacking group Scattered Spider is believed to have used social engineering to bypass multi-factor authentication. The published statement by Scattered Spider can be found here. A list of APT groups/names can be found here.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#66 - Go-to-market strategies in cybersecurity with Chad Loeven, VP Business Development at OPSWAT

LimaCharlie — Wed, 20 Sep 2023 18:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Chad Loeven, VP Business Development at OPSWAT. Chad Loeven is an experienced cybersecurity professional who leads OPSWAT's OEM technology licensing business and technology partners. OPSWAT technology helps secure over 150M endpoints by working with many of the world's largest technology vendors. They provide threat intelligence, malware analysis, vulnerability assessment, patch management, device compliance, and more.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#65 - Intel Chat: DB#JAMMER, Chae$ malware, W3LL, APT34 deploy Side Twist Trojan and government-backed actors in North Korea target security researchers.

LimaCharlie — Thu, 14 Sep 2023 14:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Securonix Threat Labs are reporting that threat actors working as part of the DB#JAMMER attack campaigns are compromising exposed MSSQL databases using brute force attacks.
AhnLab’s Security Emergency Response Center are reporting on threat actors using phishing emails to distribute some fileless malware.
The researchers over at Group-IB have uncovered a covert business email compromise phishing campaign targeting Microsoft 365.
NSFOCUS Security Labs captured a new APT34 phishing attack against enterprise targets that released a variant of the SideTwist Trojan to achieve long-term control of the victim host.
Threat Analysis Group publicly disclosed a campaign from government-backed actors in North Korea who used 0-day exploits to target security researchers working on vulnerability research and development.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#64 - A chat about enterprise security with Mathew Fulmer, Director of Cyber Threat Intelligence at BLOKWORX

LimaCharlie — Wed, 13 Sep 2023 16:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we speak with Matthew Fulmer, Director of Cyber Threat Intelligence at BLOKWORX.

With over 9 years of experience in the cyber security field, Matthew is a passionate and driven leader who strives to protect organizations from evolving and emerging threats. He has a strong background in threat intelligence, malware analysis, offensive security, and customer success, and he holds a Six Sigma Green Belt certification. As the Director of Cyber Threat Intelligence at BLOKWORX, Matthew integrates with internal teams to provide them with the latest knowledge and insights on the threat landscape and the best practices to prevent and deflect attacks.

In his previous role as the Manager of Cyber Intelligence Engineering at Deep Instinct, Matthew managed a growing team of cyber intelligence engineers who operated within the customer success organization. He was responsible for creating a new service offering, developing the professional skills of his team, analyzing threat vectors in various environments, communicating proactively with customers, creating technical articles and content, and assisting with security education. He also contributed to the malware analysis, the pre-load product, and the administrator certification course. Some of the skills that Matthew applied and enhanced in this role include network administration, information security, and technical support.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#63 - The SecOps Cloud Platform for ecosystem builders

LimaCharlie — Fri, 08 Sep 2023 17:00:00 +0000

A hosted panel discussion with industry leaders to explore what advantages the SecOps Cloud Platform confers for ecosystem builders.

The panel is moderated by LimaCharlie's Head of Product, Matt Bromiley. The panel participants are:

Senior Security Researcher at Thinkst, Casey Smith
Security Evangelist at RunZero, Huxley Barbee
Head of Tines Labs, John Tuckner

What is the SecOps Cloud Platform?

The SecOps Cloud Platform is:

An environment where many solutions can exist, not as a collection of random tools, but as a series of cybersecurity solutions designed to interoperate in an un-opinionated way, from the ground up; where powerful systems can be put in place at incredible speeds.
An environment fundamentally open through APIs, documentation, integrability, affordability; making it a neutral space for all cybersecurity professionals, whether they’re in enterprise, services or vendors to build appropriate solutions.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#62 - Cybersecurity industry trends with Ross Haleliuk, Co-Lead of the Venture in Security Angel Syndicate

LimaCharlie — Thu, 07 Sep 2023 20:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we chat with Ross Haleliuk, Co-Lead of the Venture in Security Angel Syndicate, and Head of Product at LimaCharlie.

Ross is a head of product at LimaCharlie - a startup that enables organisations to detect & respond to threats, automate processes, and future-proof their security operations. His areas of expertise include go-to-market and product strategy, B2B product-led growth, strategic positioning, product-market fit expansion, and growth. Outside of work, Ross is a startup advisor, angel investor, frequent contributor to TechCrunch, Forbes, and VentureBeat, and author of VentureinSecurity.net

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#61 - Intel Chat: QuiteRAT, CollectionRAT, Maldoc in PDF, DarkGate & the FBI takes down Qakbot

LimaCharlie — Fri, 01 Sep 2023 12:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Cisco Talos reporting on both QuiteRAT and CollectionRAT from the Lazarus Group.
JPCERT/CC has confirmed a new technique used in an attack that bypasses detection by embedding a malicious Word file into a PDF file.
Telekom Security was recently made aware via trust groups about a new malware campaign involving DarkGate .
The FBI and the Justice Department announced a multinational operation to disrupt and dismantle the malware and botnet known as Qakbot.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#60 - Building scalable security products quickly with the SecOps Cloud Platform

LimaCharlie — Tue, 29 Aug 2023 10:00:00 +0000

A hosted panel discussion with industry leaders to explore the advantages of the SecOps Cloud Platform for product builders.

The panel is moderated by LimaCharlie's Head of Product, Ross Haleliuk. The panel participants are:

Founder & CTO of Recon InfoSec, Eric Capuano
Lead Incident Detection Engineer at Blumira, Amanda Berlin

What is the SecOps Cloud Platform?

The SecOps Cloud Platform is:

The SecOps Cloud Platform is not where data goes to die—it’s a fabric, a sandbox ready for you to use, but also ready to disseminate data and insights to other systems as needed in cost-effective ways.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#59 - Intel Chat: Racoon stealer, Duke, WoofLocker, Cuba ransomware & XLoader

LimaCharlie — Fri, 25 Aug 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The return of the Racoon Stealer after temporarily being disrupted.
EclecticIQ, analysts have assessed with high-confidence two observed PDF documents that are part of an ongoing campaign targeting Ministries of Foreign Affairs of NATO aligned countries.
MalwareBytes is following up on a tech support scam campaign dubbed WoofLocker.
The threat research team at BlackBerry has discovered and documented new tools used by the Cuba ransomware threat group.
SentinelOne are reporting a new iteration of the XLoader malware-as-a-service infostealer and botnet .

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#58 - An introduction to the SecOps Cloud Platform with Maxime Lamothe-Brassard, Founder & CEO of LimaCharlie

LimaCharlie — Sun, 20 Aug 2023 06:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we chat with Maxime Lamothe-Brassard, Founder & CEO of LimaCharlie, about the SecOps Cloud Platform.

The SecOps Cloud Platform is:

An environment where many solutions can exist, not as a collection of random tools, but as a series of cybersecurity solutions designed to interoperate in an un-opinionated way, from the ground up; where powerful systems can be put in place at incredible speeds.
An environment fundamentally open through APIs, documentation, integrability, affordability; making it a neutral space for all cybersecurity professionals, whether they’re in enterprise, services or vendors to build appropriate solutions.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#57 - A discussion about security research with John Hammond, Principal Security Researcher at Huntress

LimaCharlie — Sun, 20 Aug 2023 06:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we chat with John Hammond, Principal Security Researcher at Huntress, about security research.

John Hammond is a cybersecurity researcher, educator and content creator. As part of the Threat Operations team at Huntress, John spends his days making hackers earn their access and helping tell the story. Previously, as a Department of Defense Cyber Training Academy instructor, he taught the Cyber Threat Emulation course, educating both civilian and military members on offensive Python, PowerShell, other scripting languages and the adversarial mindset. He has developed training material and information security challenges for events such as PicoCTF and competitions at DEFCON US. John speaks at security conferences such as BsidesNoVA, to students at colleges such as the US Naval Academy, and other online events including the SANS Holiday Hack Challenge/KringleCon. He is an online YouTube personality showcasing programming tutorials, CTF video walkthroughs and other cyber security content. John currently holds the following certifications: Security+, CEH, LFS, eJPT, eCPPT, PNPT, PCAP, OSWP, OSCP, OSCE, OSWE, OSEP, and OSED (OSCE(3)).

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#56 - Hacker History: When the Lights Went Out in Ukraine (Part 1)

LimaCharlie — Fri, 18 Aug 2023 09:00:00 +0000

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#55 - Intel Chat: XWorm, SugarCRM zero-day, Statc Stealer, Background Task Manager fail, Seaspy & Whirlpool

LimaCharlie — Wed, 16 Aug 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A new injector written in Rust is used to inject shellcode and introduce XWorm into a victim’s environment.
Multiple cases where the SugarCRM was the initial attack vector and allowed threat actors to gain access to AWS accounts.
Statc Stealer is a sophisticated malware that infects devices powered by Windows, gains access to computer systems and steals sensitive information.
Patrick Wardle's research says that macOS's Background Task Manager can be easily bypassed and that Apple failed to act on his recommendations to fix it.
CISA are reporting on the Seaspy and Whirlpool backdoors after obtaining malware samples from a compromised device.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#54 - A discussion about Linux ransomware with David Burkett, founder of Signalblur

LimaCharlie — Thu, 10 Aug 2023 12:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we chat with David Burkett, Founder of Signalblur, about the growing threat of Linux ransomware.

His expertise is backed by a strong set of GIAC certifications, including GCTI, GCIA, GPYC, and GCED... among others. David is proud to have been part of a security team that won the prestigious James S. Cogswell Outstanding Industrial Security Achievement Award from the Defense Counterintelligence and Security Agency.

David is constantly seeking opportunities to grow and learn and is eager to connect with like-minded professionals in the cybersecurity domain.

The article on Linux ransomware referenced in the podcast can be found here: A Deep Dive into Linux Ransomware Research

And David's previous appearance on the show can be found here: Episode #6

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#53 - The future of enterprise SecOps: a panel discussion with industry leaders

LimaCharlie — Thu, 03 Aug 2023 14:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast we host a panel discussion with industry leaders and explore the advantages of the SecOps Cloud Platform for securing enterprise organizations.

The panel is moderated by LimaCharlie's Chief Revenue Officer, Jessica Crytzer. The panel participants are:

Founder & CEO of LimaCharlie, Maxime Lamothe-Brassard
Founder & CEO of Turngate, Bruce Potter
Head of Product, Interpres Security, Fred Wilmot
Principal Consultant at Higgins Cybersecurity Consulting, Sean Higgins

What is the SecOps Cloud Platform?

The SecOps Cloud Platform is:

An environment where many solutions can exist, not as a collection of random tools, but as a series of cybersecurity solutions designed to interoperate in an un-opinionated way, from the ground up; where powerful systems can be put in place at incredible speeds.
An environment fundamentally open through APIs, documentation, integrability, affordability; making it a neutral space for all cybersecurity professionals, whether they’re in enterprise, services or vendors to build appropriate solutions.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#52 - Intel Chat: Mallox, Decoy Dog, Casbaneiro, Nitrogen, search-ms exploit, & the BlackLotus

LimaCharlie — Wed, 02 Aug 2023 05:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Decoy Dog is a malware toolkit that cleverly uses DNS to perform command and control.
Breaking down the infection chain for Casbaneiro, another banking trojan targeting Latin America.
An initial-access malware campaign that leverages malicious advertising - or malvertising - to impersonate legitimate software and compromise business networks.
The VirusTotal Malware Trends Report: Emerging Formats and Delivery Techniques.
Trellix Advanced Research Center who have identified a novel method for exploiting the ‘search-ms” protocol handler.
The source code of the BlackLotus Unified Extensible Firmware Interface - or UEFI - rootkit was leaked on GitHub.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#51 - Building high-performance cybersecurity teams: a chat with David Seidman, Head of Detection & Response at Robinhood

LimaCharlie — Thu, 27 Jul 2023 17:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we chat with David Seidman, Head of Detection & Response at Robinhood, about building high-performance teams.

David manages the Detection & Response team at Robinhood, and is responsible for detection, incident response, and D&R infrastructure. Robinhood's Platform team develops the "pipes and engines": log ETL, transport, data lake, Splunk, SIEM, SOAR, experimental tech, etc. Robinhood emphasizes engineering excellence and agility - they are moving fast and getting a lot done.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#50 - Intel Chat: AgentTesla, Cobalt Strike, njRAT, LokiBot, SophosEncrypt, BundleBot, and targetted OSS supply chain attacks

LimaCharlie — Wed, 26 Jul 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Cisco Talos has discovered a threat actor conducting several campaigns against government entities, military organizations, and civilian users in Ukraine and Poland.
FortiGuard Labs investigation the researchers came across several Malicious Office documents designed to exploit known vulnerabilities.
Cybersecurity vendor Sophos is being impersonated by a new ransomware-as-a-service called SophosEncrypt.
CheckMarx is reporting the first known targeted OSS supply chain attacks against the banking sector.

The LimaCharlie SecOps Cloud Platform provides organizations with comprehensive enterprise protection that brings together critical cybersecurity capabilities and eliminates integration challenges and security gaps for more effective protection against today’s threats.

Watch the SecOps Cloud Platform panel discussions here: Introducing the SecOps Cloud Platform

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#49 - The history of LimaCharlie with Founder & CEO, Maxime Lamothe-Brassard

LimaCharlie — Fri, 21 Jul 2023 09:00:00 +0000

On this episode of The Cybersecurity Defenders Podcast, we sit down with LimaCharlie Founder & CEO, Maxime Lamothe-Brassard, and talk about the history and vision of the SecOps Cloud Platform.

About the SecOps Cloud Platform:

The SecOps Cloud Platform is:

An environment where many solutions can exist, not as a collection of random tools, but as a series of cybersecurity solutions designed to interoperate in an un-opinionated way, from the ground up; where powerful systems can be put in place at incredible speeds.
An environment fundamentally open through APIs, documentation, integrability, affordability; making it a neutral space for all cybersecurity professionals, whether they’re in enterprise, services or vendors to build appropriate solutions.

About Maxime:

After graduating from the University of Victoria with a degree in Computer Science Maxime began his career in cybersecurity working for the Canadian Government as part of the Communications Security Establishment (CSE). CSE is Canada's national cryptologic agency, providing the Government of Canada with information technology security and foreign signals intelligence. As part of the Canadian Intelligence apparatus, Maxime worked in positions ranging from the development of cyber defense technologies, Counter Computer Network Exploitation and Counter Intelligence.

After leaving the government, Maxime provided direct help to private and public organizations in matters of cyber defense. He was an early employee at Crowdstrike, then worked for Google where he eventually landed in Google X. Maxime left Google X - where he was a founding member of Chronicle Security - in 2018 to found LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#48 - Intel Chat: Rust Bucket, RedEnergy, Charming Kitten, Truebot variants, Big Head & TOITOIN

LimaCharlie — Thu, 13 Jul 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The RustBucket malware allows operators to download and execute various payloads.
Zscaler ThreatLabz researchers discovered a new Stealer-as-a-Ransomware named RedEnergy used in attacks against energy utilities, oil, gas, telecom, and machinery sectors.
Charming Kitten sends a lure masquerading as a senior fellow with the Royal United Services Institute to a public media contact for a nuclear security expert at a US-based think tank focused on foreign affairs.
New Truebot malware variants deployed on networks compromised using a critical remote code execution vulnerability in the Netwrix Auditor software.
TrendMicro is reporting a new ransomware family and its variant named Big Head.
Zscaler ThreatLabz has recently uncovered a new targeted attack campaign striking businesses in the Latin American region.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#47 - Tips for submitting papers to conferences with Huxley Barbee, organiser at BSidesNYC

LimaCharlie — Thu, 06 Jul 2023 15:00:00 +0000

On this episode of the Cybersecurity Defenders Podcast, we have a conversation around best practices for submitting papers to conferences with Huxley Barbee, Security Evangelist at runZero & organizer of BSidesNYC.

Throughout Huxley's career, he has held key positions at Cisco, Datadog and now runZero. He is passionate about cybersecurity and supporting the community in order to create a better security posture for all.

Huxley encourages our listeners to connect with him on various platforms as linked below.

Some resources for finding conferences to submit papers to are linked below.

Infosec Conferences
CFP Time
Security BSides
Pulesdive's list of threat intel conferences

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#46 - Intel Chat: RedEyes, The Flea, JS dropper delivering Bumblebee & IcedID, and free smartwatches

LimaCharlie — Thu, 29 Jun 2023 15:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

ASEC discovered that RedEyes is distributing and using an infostealer with wiretapping features.
Symantex is reporting that The Flea has continued to focus on foreign ministries in a recent attack campaign that ran from late 2022 into early 2023.
Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID
Rapid7 researchers recently undertook a project to analyze managed file transfer applications, due to the number of recent vulnerabilities discovered.
Members across the military have reported receiving smartwatches unsolicited in the mail.

And you can register here to attend the LinkedIn Live Event, An Invitation to Change: Introducing the SecOps Cloud Platform

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#45 - Hacker History: SolarWinds

LimaCharlie — Wed, 28 Jun 2023 14:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we recount some hacker history, and with the help of John Bambenek, tell the story of one of the largest and most complicated supply chain attacks in history: SolarWinds

On December 13, 2020, The Washington Post reported that multiple government agencies were breached through SolarWinds's Orion software.

Victims of this attack include the cybersecurity firm FireEye, the US Treasury Department, the US Department of Commerce's National Telecommunications and Information Administration, as well as the US Department of Homeland Security.Prominent international SolarWinds customers investigating whether they were impacted include the North Atlantic Treaty Organization (NATO), the European Parliament, UK Government Communications Headquarters, the UK Ministry of Defence, the UK National Health Service (NHS), the UK Home Office, and AstraZeneca. FireEye reported the hackers inserted "malicious code into legitimate software updates for the Orion software that allow an attacker remote access into the victim's environment" and that they have found "indications of compromise dating back to the spring of 2020". FireEye named the malware SUNBURST. Microsoft called it Solorigate.

The attack used a backdoor in a SolarWinds library; when an update to SolarWinds occurred, the malicious attack would go unnoticed due to the trusted certificate.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#44 - Intel Chat: Fake GitHub repos, NPM poison, Vidar, Mac malware, Tsunami DDOS, Cl0p reward, and the EDR killer: Spyboy

LimaCharlie — Sat, 24 Jun 2023 16:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

VulnCheck comes across a malicious GitHub repository that is claimed to be a Signal 0-day.
CheckMarx are reporting that Without altering a single line of code, attackers poisoned the NPM package “bignum” by hijacking a S3 bucket.
Team CYMRU has released a detailed publication on Vidar infrastructure which encompasses both the primary administrative aspects and the underlying backend.
Bit Defender Mac researchers stumbled upon a small set of files with backdoor capabilities that seem to form part of a more complex malware toolkit.
Researchers have found an unofficial package called 'https' that exists on NPM with over 1600 other packages that depend on it.
An attack campaign that consists of the Tsunami DDoS Bot being installed on inadequately managed Linux SSH servers.
Cl0p rewards of up to $10 million are being offered by the U.S. State Department's Rewards for Justice program.
SentinelOne is reporting on the Terminator EDR killer - Spyboy.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#43 - A conversation about AI in cybersecurity with Jon Bagg, Founder & CEO of Salem Cyber

LimaCharlie — Wed, 21 Jun 2023 14:00:00 +0000

On this episode of the Cybersecurity Defenders Podcast, we have a conversation about AI in cybersecurity with Jon Bagg, Founder & CEO of Salem Cyber.

Jon Bagg is the creator of Salem Cyber, an innovative cyber analysis technology that helps scale their alert investigation capacity so they can find threats in the noise.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#42 - Intel Chat: Atomic Wallet, Azure goes down, BEC justice, FortiOS SSL VPN and the BatCloak

LimaCharlie — Thu, 15 Jun 2023 11:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

$35 million has reportedly been stolen from users of Atomic Wallet.
On June 9th the Microsoft Azure Portal was down on the web as a result of suspected DDOS.
The US Department of Justice has indicted 6 people for their involvement in a $6 million dollar business email compromise scam.
CVE-2023-27997 was reported by Fortinet on June 13th (Fortinet hardening guide).
Trend Micro recently discovered the use of heavily obfuscated batch files utilizing the advanced BatCloak engine.
And a really cool PDF - the Cy-Xplorer 2023 report put out by Orange Cyberdefense.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#41 - A conversation about edge computing with Theresa Lanowitz, Head of Evangelism and Portfolio Marketing at AT&T Cybersecurity

LimaCharlie — Tue, 13 Jun 2023 14:00:00 +0000

On this episode of the Cybersecurity Defenders Podcast, we have a conversation about edge computing with Theresa Lanowitz, Head of Evangelism and Portfolio Marketing at AT&T Cybersecurity.

Theresa Lanowitz is a proven global influencer and speaks on trends and emerging technology poised to help today’s enterprise organizations flourish. Theresa is currently the head of evangelism at AT&T Business - Cybersecurity.

Prior to joining AT&T, Theresa was an industry analyst with boutique analyst firm voke and Gartner. While at Gartner, Theresa spearheaded the application quality ecosystem, championed application security technology, and created the successful Application Development conference.

As a product manager at Borland International Software, Theresa launched the iconic Java integrated development environment, JBuilder. While at Sun Microsystems, Theresa led strategic marketing for the Jini project – a precursor to IoT (Internet of Things).

Theresa’s professional career began with McDonnell Douglas where she was a software developer on the C-17 military transport plane and held a US Department of Defense Top Secret security clearance.

Theresa holds a Bachelor of Science in Computer Science from the University of Pittsburgh, Pittsburgh, PA.

The report referenced in the podcast can be acquired here: 2023 AT&T Cybersecurity Insight Report: Edge Ecosystem

The open-source Genie Framework referenced in the podcast can be viewed here: Genie Framework

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#40 - Intel Chat: BlackCat, RaidForums Exposed, MOVEit Transfer, Camaro Dragon, mystery iOS malware, TrueBot and the Cyclops Ransomware & Stealer combo

LimaCharlie — Thu, 08 Jun 2023 16:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

BlackCat makes some changes geared towards improving its tradecraft and increasing the likelihood of data theft and encryption.
A new hacking forum called Exposed has publicly leaked a substantial database from the infamous RaidForums.
A critical vulnerability in the MOVEit Transfer software.
Camaro Dragon targets European foreign affairs entities linked to Southeast and East Asia.
Kaspersky is reporting on some unknown malware targeting iOS devices.
The Hacker News is reporting a surge in TrueBot activity that was observed starting in May 2023.
Uptycs is reporting on the threat group behind the Cyclops ransomware and stealer combo.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#39 - A conversation about DFIR with Devon Ackerman, Global Service Line Leader for Digital Forensics and Incident Response Kroll

LimaCharlie — Tue, 06 Jun 2023 05:00:00 +0000

On today's episode of The Cybersecurity Defenders Podcast we are joined Devon Ackerman, Global Service Line Leader for Digital Forensics and Incident Response (DFIR) services at Kroll Cyber.

Prior to Kroll, Devon served as a Supervisory Special Agent at the FBI's Operational Technology Division in the CART Field Operations Unit. He navigated digital forensic issues, managed 56 FBI Division executive management relationships, organized team deployments during mass incident response events such as the San Bernardino Domestic Terrorism shooting (Apple iPhones), and served as a senior certified Forensic Examiner (CART) for on-scene collections and forensic analysis.

As mentioned in the show, an excellent resource for all things DFIR: aboutDFIR.com

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#38 - Intel Chat: Donut, Agrius, Kimsuky, Pikabot, QBot & the Gootloader Initial Access-as-a-Service Operation.

LimaCharlie — Thu, 01 Jun 2023 14:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

FortiGaurd Labs encounters a kernel driver that makes use of the open-source donut tool.
Checkpoint researchers observe Iranian threat actor Agrius operating against Israeli targets.
SentielOne notes changes in the ongoing campaign by Kimsuky.
Microsoft uncovers stealthy malicious activity aimed at critical infrastructure in the United States.
ZScaler Threatlabz reporting on Pikabot, a new malware trojan.
Bleeping Computer reporting that the QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program.
eSentire launches a multi-pronged offensive against a growing cyberthreat: the Gootloader Initial Access-as-a-Service Operation.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#37 - A conversation about securing the build pipeline with Adnan Khan, Lead Security Engineer at Praetorian

LimaCharlie — Tue, 30 May 2023 06:00:00 +0000

On today's episode of The Cybersecurity Defenders Podcast we are joined by security engineer Adnan Khan to talk about securing the build pipeline and explore some common vulnerabilities in enterprise Github configurations.

Organizations using GitHub Actions with self-hosted runners are at risk of attackers gaining an internal network foothold from the Internet if they compromise one developer’s personal GitHub access token. Key configuration adjustments can secure these pipelines and limit the damage from a breach.

Adnan's talk at BSidesSF: Securing the Pipeline: Protecting Self-Hosted HitHub Runners

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#36 - Intel Chat: Red Stinger, 3 new Apple Zero Days, the GuLoader, BlackCat and the Golden Jackal

LimaCharlie — Thu, 25 May 2023 04:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Malware Bytes researchers reporting on the Red Stinger group which has targeted entities in Ukraine.
Apple is reporting three new zero days affecting iPhones, iPads, Macs and even Apple watches and TVs.
The folks over at CISCO Talos have recently identified a new RA group that has been operating since at least April 22, 2023.
Check Point researchers have uncovered the GuLoader that has been used in a large number of attacks.
Trend Micro is reporting on a new capability seen in a BlackCat ransomware incident.
Kaspersky is introducing the world to a new APT group they are calling GoldenJackal.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#35 - A conversation about mental health in cybersecurity with Amanda Berlin, CEO of Mental Health Hackers

LimaCharlie — Wed, 24 May 2023 05:00:00 +0000

On this episode of the Cybersecurity Defenders Podcast, we have a conversation about mental health in cybersecurity with Amanda Berlin, CEO of Mental Health Hackers.

Mental Health Hackers' stated mission is to educate tech professionals about the unique mental health risks faced by those in our field – and often by the people who we share our lives with – and provide guidance on reducing their effects and better manage the triggering causes.

They also aim at providing support services to those who may be susceptible to related mental health issues such as anxiety, depression, social isolation, eating disorders, etc.

If you are struggling please know that there are a lot of people in your community that care, as well as resources that you can access.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#34 - Special Episode: Operation Medusa cuts the head off of the Snake using PEGASUS software

LimaCharlie — Thu, 18 May 2023 19:00:00 +0000

On this special episode of the Cybersecurity Defenders Podcast, we have a longer-form discussion about the recent FBI takedown of the Russian malware known as Snake. The FBI dismantled the global peer-to-peer network of Snake-infected computers with Operation MEDUSA in coordination with multiple cybersecurity agencies.

Resources referenced in this show:

Press release from the Department of Justice
CISA's cybersecurity advisory
CISA breakdown of the Snake malware

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#33 - Hacker History: Stuxnet (Part 2)

LimaCharlie — Tue, 16 May 2023 07:00:00 +0000

This episode of the Cybersecurity Defenders podcast is the second part in a two-part mini-series about the greatest cyber attack ever conceived: Stuxnet.

Joining to help us tell the story is Kim Zetter, Journalist and Author - Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon.

If you have not heard the first episode it is recommended that you do so before listening to this one. You can listen to the first episode here: Stuxnet (Part 1)

Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005. Stuxnet targets supervisory control and data acquisition (SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, the worm is widely understood to be a cyberweapon built jointly by the United States and Israel in a collaborative effort known as Operation Olympic Games. The program, started during the Bush administration, was rapidly expanded within the first months of Barack Obama's presidency.

This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#32 - Intel Chat: APT41, Sidewinder & Operation Medusa cuts the head off of Snake

LimaCharlie — Thu, 11 May 2023 10:00:00 +0000

In this episode of the Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Threatmmon have uncovered a targeted PowerShell backdoor malware attack that bypasses normal detection methodology.
Researchers have uncovered an attack that is based on a classic sideloading technique with a twist in which a first-stage clean application sideloads a second clean application and auto-executes it.
US authorities have announced the seizure of 13 internet domains.
The Blackberry Threat Research and Intelligence team has discovered a new campaign from the Sidewinder APT group against Pakistani government organizations.
CISA has issued an advisory letting the public know that the FBI has used a court order to take down a Russian government-controlled malware network.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#31 - Intel Chat: 3CX Inception, QuaDream goes down, APTs targeting for destruction, AMOS & AuKill

LimaCharlie — Thu, 04 May 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The initial attack vector of 3CX’s network was via malicious software downloaded from Trading Technologies website
QuaDream has allegedly fired all of its staff and is shutting down its operations in the coming days
State-sponsored campaigns targeting global infrastructure: looks like obvious targeting to support future destructive attacks
A new information-stealing malware called Atomic macOS Stealer (AMOS)
Attackers have been observed attempting to disable EDR clients with a new defensive evasion tool we’ve dubbed AuKill

A new report put out by the National Cyber Security Centre is meant to help defenders understand selected malware threats in more technical depth, and provide indicators and TTPs to support threat hunting or modeling: View the Report

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#30 - A conversation on the history of security tooling with Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud

LimaCharlie — Tue, 02 May 2023 16:00:00 +0000

On this episode of the Cybersecurity Defenders podcast we have a conversation around the history of security tooling with Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud.

Dr. Anton Chuvakin is currently involved with security solution strategy at Google Cloud, where he arrived via Chronicle Security (an Alphabet company) acquisition in July 2019. He is also a co-host of Cloud Security Podcast http://www.twitter.com/CloudSecPodcast

In addition, Anton taught classes (including his own SANS SEC434 class on log management) and presented at many security conferences across the world; he recently addressed audiences in United States, UK, Singapore, Spain, Russia and other countries. He worked on emerging security standards and served on the advisory boards of several security start-ups.

Before joining Gartner in 2011, Anton was running his own security consulting practice www.securitywarriorconsulting.com, focusing on SIEM, logging and PCI DSS compliance for security vendors and Fortune 500 organizations. Anton earned his Ph.D. degree from Stony Brook University.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#29 - A focused discussion on ransomware with Paul Ihme, Co-Founder and Managing Principle at Soteria Security Solutions and Advisory

LimaCharlie — Tue, 25 Apr 2023 18:00:00 +0000

On this episode of the Cybersecurity Defenders podcast we have a focused discussion on ransomware with Paul Ihme, Co-Founder and Managing Principle at Soteria Security Solutions and Advisory.

Paul is a cybersecurity professional with experience in federal and private environments. Wide array of expertise in multiple information technology domains, specializing in penetration testing, vulnerability assessments, and security incident response.

The blog article, "Ransomware Is Irrelevant (Wait WHAT?!)" written by Adrian Sanabria that is referenced in the podcast can be viewed here.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#28 - Intel Chat: Balada injector, Lockbit, the Legion hacktool, Nokoyawa ransomware, Domino malware and more.

LimaCharlie — Wed, 19 Apr 2023 03:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Over 1 million Wordpress sites have been infected by the Balada Injector malware
Nokoyawa ransomware attacks are being seen in the wild exploiting a Windows zero-day
An emerging Python-based credential harvester and hacktool, named Legion
A recently discovered malware family being called “Domino”
Care increasingly using the Action1 remote access software for persistence on compromised networks
A ransomware group has created encryptors targeting Macs for the first time
And a Chrome type confusion issue in the V8 Javascript engine

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#27 - Intel Chat: Apple zero-days to the end of the Genesis Market. And a dive into OT security with Dave Cullen, Field CTO of OTORIO

LimaCharlie — Wed, 12 Apr 2023 07:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Emergency security updates issued by Apple: CVE-2023-28206 & CVE-2023-28205 .
Check Point researchers have unveiled a new sophisticated and fast acting ransomware.
eFile.com, an IRS-authorized e-file software service provider used by many for filing their tax returns, has been caught serving JavaScript malware.
The CrowdStrike Falcon OverWatch team recently observed threat actors exploit WinRAR self-extracting archives.
FBI, Europol and the Dutch Police have disrupted the infamous browser cookie market known as Genesis Market.
Microsoft’s Digital Crimes Unit along with a cybersecurity software company Fortra and Health Information Sharing and Analysis Center are taking technical and legal action to disrupt cracked, legacy copies of Cobalt Strike.

And then we dive into OT security with Dave Cullen, Field CTO for OTORIO.

As mentioned in the podcast, here is a link to the “So you want to be a SOC Analyst?” by Eric Capuano.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#26 - Intel Chat: 3CX to APT43. And a deep dive on the Capital One breach with Cloud Threat Detection Engineer, Day Johnson

LimaCharlie — Wed, 05 Apr 2023 23:00:00 +0000

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Crowdstrike reports the 3CX supply chain attack.
Agents arrested Conor Brian Fitzpatrick on a charge of conspiracy to commit access device fraud.
SentinelOne reporting on the CatB ransomware family which is sometimes referred to as CatB99 or Baxtoy.
A new everything infostealer on the dark market called Radamanthys.
Mandiant has assessed with high confidence they identified a new APT: APT43.

And then we deep dive the Capital One data breach discovered on July 19, 2019, with DataDog Cloud Threat Detection Engineer, Day Johnson.

As mentioned in the podcast, Day's cybersecurity education-focused YouTube channel can be found here: @daycyberwox

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#25 - Hacker History: Stuxnet (Part 1)

LimaCharlie — Wed, 29 Mar 2023 09:00:00 +0000

This episode of the Cybersecurity Defenders podcast is the first part in a two-part mini-series about the greatest cyber attack ever conceived: Stuxnet.

Joining to help us tell the story is Kim Zetter, Journalist and Author - Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon.

This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#24 - Intel Chat: MS Outlook exploit. And ShmooCon organizers, Heidi and Bruce Potter.

LimaCharlie — Wed, 22 Mar 2023 07:00:00 -0100

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

CVE-2023-23397: A zero-touch exploit that affects all versions of Windows Outlook. (Sigma rule)
CVE-2023-24880: An unpatched security bypass in Microsoft’s SmartScreen security feature.
Mandiant observes China-nexus threat actors targeting technologies that do not normally support endpoint detection and response solutions.
Kaspersky recently conducted an analysis of 155 dark web forums from January 2020 to June 2022. Threat groups are offering $240k salaries to tech jobseekers.

And an interview with Heidi and Bruce Potter, ShmooCon organizers.

ShmooCon is an annual east coast hacker convention hell-bent on offering three days of an interesting atmosphere for demonstrating technology exploitation, inventive software, and hardware solutions, and open discussions of critical infosec issues.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#23 - Intel chat with Matt Bromiley and an interview with Joe Schreiber, Co-founder & CEO of appNovi.

LimaCharlie — Wed, 15 Mar 2023 22:00:00 -0100

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

A new Microsoft Word Vulnerability: CVE-2023-21716.
The Emotet botnet is back spamming again.
A previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities.
A SpaceX vendor has been compromised by a LockBit affiliate.
Ring LLC, the home security and smart home company owned by Amazon, has been ransomed by ALPHV ransomware group.

And an interview with Joe Schreiber, Co-founder and CEO of appNovi.

Joe has been doing IT security since dial-up. He utilizes his knowledge and experience as a practitioner, software developer, and business developer to build highly functional, scalable, usable and quality software.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#22 - An intel chat with Matt Bromiley and an interview with Rich Heimann, Chief AI Officer at SilverSky.

LimaCharlie — Wed, 08 Mar 2023 06:00:00 -0100

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel:

Menlo Labs has uncovered an unknown threat actor that’s running an evasive threat campaign which is being distributed via Discord and is targeting government entities.
TA569 is a prolific threat actor who has been deploying website injections that run a Javascript payload known as SocGholish.
The risk to business from burned-out analysts.
The emerging post-explotation framework, EXFILTRATOR-22 or EX-22.

And an interview with Rich Heimann, Chief AI Officer at SilverSky, where we talk about Machine Learning and Artificial Intelligence as they relate to cybersecurity.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#21 - A intel chat with Matt Bromiley and an interview with Nick Gipson, Director of Cyber Operations at Pareto Cyber.

LimaCharlie — Wed, 01 Mar 2023 07:00:00 -0100

In this episode, we sit down with Matt Bromiley to talk about some of the latest intel coming out of the LimaCharlie community Slack channel. After that, an interview with Nick Gipson, Director of Cyber Operations at Pareto Cyber.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#20 - Hacker History: WannaCry

LimaCharlie — Wed, 22 Feb 2023 06:00:00 -0100

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history, and with the help of Marcus Hutchins, tell the story of the WannaCry ransomware attack.

The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It propagated by using EternalBlue, an exploit developed by the United States National Security Agency (NSA) for Windows systems. EternalBlue was stolen and leaked by a group called The Shadow Brokers a month prior to the attack.

Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#19 - Simply Cyber Report for February 15. Plus a conversation with Ira Winkler, Field CISO and Vice President of CYE

LimaCharlie — Wed, 15 Feb 2023 05:00:00 -0100

This week on the Simply Cyber Report:

Scores of Redis servers infested by sophisticated custom-built malware.
Oktapus hackers are back and targeting tech and gaming companies.
Russian hackers using new Graphiron information stealer in Ukraine.
New QakNote attacks push QBot malware via Microsoft OneNote files.
Fresh, buggy Clop ransomware variant targets Linux systems.

We also sit down with Ira Winkler, Field CISO and Vice President of CYE. Ira shares a wide range of thoughts and experiences garnered from an exceptional career.

You can find the various books that Ira has written, which are mentioned in the podcast, at the following links:

You CAN Stop Stupid
Advanced Persistent Security
Security Awareness for Dummies
Cybersecurity All-in-one For Dummies

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#18 - The Adversary Toolbox: BITS jobs. Plus an interview with Tyler Shields, entrepreneur and angel investor.

LimaCharlie — Wed, 08 Feb 2023 07:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Matt Bromiley opens up the Adversary Toolbox to tell us all about BITS jobs.

We also sit down with Tyler Shields: a cybersecurity veteran, entrepreneur, and angel investor. In our conversation, we talk about the economic conditions driving the tech sector layoffs we are seeing, what zombie companies are, and speculate on the future of AI.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#17 - Simply Cyber Report for Feb 1. Plus a conversation with Michael Argast, Co-founder & CEO of Kobalt.io

LimaCharlie — Wed, 01 Feb 2023 06:00:00 -0100

Microsoft has started blocking the execution of XLL add-ins downloaded from the Internet. The hacking group DragonSpark is leveraging Golang source code interpretation to evade detection. Threat actors are turning to Sliver to replace more popular frameworks Cobalt Strike and Metasploit. Over 4,500 WordPress sites have been hacked and Emote malware makes a comeback. Emotet is back with new evasion techniques in MS Excel.

We also sit down with Michael Argast, Co-founder and CEO of Kobalt.io. We learn about Kobalt's approach to scaling cybersecurity services for small and medium-sized businesses, and also some great advice on what it takes to build services for this part of the market. A great conversation that is full of tidbits of wisdom for anybody looking to start a security services company.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#16 - Hacker History: NotPetya

LimaCharlie — Thu, 26 Jan 2023 06:00:00 -0100

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history and tell the story of Amit Serper, a hacker and reverse engineer, who was instrumental in stopping the most devastating cyber attack in history: NotPetya.

On 27 June 2017, a major global cyberattack began (Ukrainian companies were among the first to state they were being attacked), utilizing a new variant of Petya. On that day, Kaspersky Lab reported infections in France, Germany, Italy, Poland, the United Kingdom, and the United States, but that the majority of infections targeted Russia and Ukraine, where more than 80 companies were initially attacked, including the National Bank of Ukraine. ESET estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%.Russian president Vladimir Putin's press secretary, Dmitry Peskov, stated that the attack had caused no serious damage in Russia. Experts believed this was a politically-motivated attack against Ukraine, since it occurred on the eve of the Ukrainian holiday Constitution Day.

Kaspersky dubbed this variant "NotPetya", as it has major differences in its operations in comparison to earlier variants. McAfee engineer Christiaan Beek stated that this variant was designed to spread quickly, and that it had been targeting "complete energy companies, the power grid, bus stations, gas stations, the airport, and banks".

This episode was written by Nathaniel Nelson, narrated by Christopher Luft and produced by the team at LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#15 - The Adversary Toolbox: RDP. Plus an interview with Michael Laudenslager, VP of Cybersecurity at Churchill Mortgage

LimaCharlie — Wed, 18 Jan 2023 15:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Matt Bromiley opens up the Adversary Toolbox to tell us all about RDP.

We also sit down with Michael Laudenslager, VP of Cybersecurity at Churchill Mortgage and talk about security in the cloud.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#14 - Simply Cyber Report for Jan 12. Plus a conversation with Walter Haydock, Founder and CEO of StackAware.

LimaCharlie — Thu, 12 Jan 2023 16:00:00 -0100

Unknown threat actors have been observed hiding malware execution behind a legitimate Windows support binary. S3 buckets are now encrypted by default. A powerful Android malware has been tuned to target banking applications. And it is the end of life for Windows Server 2008.

We also sit down with Walter Haydock, Founder and CEO of StackAware. We learn about StackAware and their approach to vulnerability management, and also how Walter got his company off of the ground using low-code tooling. A fascinating conversation for anyone looking to start their own cybersecurity company.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#13 - Hacker History: Titan Rain

LimaCharlie — Wed, 04 Jan 2023 17:00:00 -0100

Titan Rain was a series of coordinated attacks on computer systems in the United States since 2003; they were known to have been ongoing for at least three years. The attacks originated in Guangdong, China. The activity is believed to be associated with a state-sponsored advanced persistent threat. It was given the designation Titan Rain by the federal government of the United States.

This episode was written by Nathaniel Nelson, narrated by Christopher Luft and produced by the team at LimaCharlie.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#12 - Simply Cyber Report for December 28. Plus an interview with Jason Chan, former VP of Security at Netflix.

LimaCharlie — Wed, 28 Dec 2022 12:00:00 -0100

New vulnerability found in WooCommerece Gift Cards Premium Wordpress plugin with CVSS score of 9.8.

Fin7 has developed an AI-powered automated attacking tool called Checkmarks. Checkmarks is designed to auto-attack ms exchange systems, perform post exploitation actions, and grab enough data to allow FIN7 to understand their victim.

Raspberry Robin has a new feature. This version of Raspberry Robin has two payloads, one designed to be discovered if the malware believes it's being analyzed in a sandbox. This fake payload look legit including looking at the registry on start up to check for infection, pulling down an adware named 'browserassist'. This payload has shellcode and a PE file with the MZ magic bytes removed to hide its not a PE file.

Plus an interview with Jason Chan, former VP of Information Security at Netflix about how he helped build their security program from the ground up.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#11 - The Adversary Toolbox: WinRM + PowerShell Remoting. Plus Zack Allen, Director of Security Detection & Research at Datadog.

LimaCharlie — Wed, 21 Dec 2022 15:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Matt Bromiley opens up the Adversary Toolbox to tell us all about WinRM + PowerShell Remoting.

We also sit down with Zack Allen, Director of Security Detection & Research at Datadog, about managing uncertainty, some of his favorite tools, and building quality detections.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#10 - Simply Cyber Report for December 14. Plus a conversation with several Open Source cybersecurity founders.

LimaCharlie — Wed, 14 Dec 2022 16:00:00 -0100

The Simply Cyber Report for December 14, 2022.

Go-based malware named Zerobot in the wild. Android malware dubbed "Zombinder" a Just-in-time Trojan style malware. Iranian based APT, has been pushing hard with remote administration tooling.

A roundtable conversation with several Open Source cybersecurity founders. During the conversation we discuss the complexities of open-source as it relates to cybersecurity, the effects it has on the industry, funding models, what inspired these projects, how they came to be, how they are trying to grow, and any lessons - good or bad - they have learned along the way.

The panelist include:

Zach Wasserman from osquery
Lennart Koopmann from Graylog, Inc.
Peter Manev from Suricata

And we acknowledge some heavy audio compression during the roundtable conversation. We will be employing some new recording technology for future group conversations.

As always, we would love to hear from you. Questions, feedback and ideas can be directed to defenders@limacharlie.io

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#9 - Predictions for the future from 2022

LimaCharlie — Wed, 07 Dec 2022 16:00:00 -0100

As we get ready to say goodbye to 2022 the team at the Cybersecurity Defenders podcast thought it would be nice to review all the predictions for the future made by guests on this show so far.

It is a fun episode and will be interesting to circle back on next year at the same time.

In the show, we talk about Dr. Joseph Burt-Miller Jr's study hall group on Discord - here is the link for anybody interested in checking it out: https://discord.gg/Z8gaAvnS4m

As always, your feedback is always welcome. If you have any criticisms or ideas for the show, please don't hesitate to reach out to us at defenders@limacharlie.io

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#8 - Simply Cyber Report for Nov 30 and Daniel Velasquez of Ground Truth Connections

LimaCharlie — Wed, 30 Nov 2022 15:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Dr. Gerald Auger takes us through the last couple of weeks in cybersecurity news via the Simply Cyber Report.

We also sit down with Daniel Velasquez, founder of Ground Truth Connections.

Daniel has had a very interesting career. He has been a drone pilot inside of a war zone, worked in signals intelligence, been a CIA Targeter and risen through the ranks at Mandiant. Daniel is now the CEO and Founder of Ground Truth Connections who are operating on the ground in Ukraine with a humanitarian mission.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#7 - Hacker History: Operation Flyhook

LimaCharlie — Wed, 23 Nov 2022 17:00:00 -0100

This episode was written by Nathaniel Nelson, narrated by Christopher Luft, and produced by the team at LimaCharlie.

Any questions or feedback can be directed to defenders@limacharlie.io

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#6 - Simply Cyber Report for Nov. 16 and David Burkett, Cloud Detection Engineer

LimaCharlie — Wed, 16 Nov 2022 15:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Dr. Gerald Auger takes us through the last couple of weeks in cybersecurity news via the Simply Cyber Report.

We also sit down with David Burkett, co-author of Detectors as Code.

David is an experienced Information Security Architect with a demonstrated history of working in the security industry in both Government and the Telecommunications / Service Provider Industries. He is skilled in Security Information and Event Management, Security Monitoring, Python, and Digital Forensics among other things.

IN our talk with David about UAPs he references this video: Navy pilot describes encounter with UFOs

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#5 - The Adversary Toolbox: PaExec. Plus Eric Capuano, Founder & CEO of Recon Infosec

LimaCharlie — Wed, 09 Nov 2022 14:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Matt Bromiley opens up the Adversary Toolbox and tells us all about PaExec.

We also sit down to chat with Eric Capuano, Founder and CEO of Recon Infosec.

During the conversation with Eric, we talk about many different things including the OpenSoc Network Defense Range and their new Thursday Defensive webcast.

If you have any suggestions or feedback please don't hesitate to reach out to us: defenders@limacharlie.io

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#4 - Simply Cyber Report for Nov. 2 and Paul Caiazzo of SnapAttack

LimaCharlie — Wed, 02 Nov 2022 14:00:00 -0100

In this episode of the Cybersecurity Defenders Podcast, Dr. Gerald Auger takes us through the last couple of weeks in cybersecurity news via the Simply Cyber Report

We also sit down with Paul Caiazzo: cybersecurity expert, entrepreneur and strategist, CISO and CPO.

Paul has dedicated his career to advancing the field of global cyber security. In his current role as Chief Growth Officer at SnapAttack, Paul focuses on product/market fit, strategic partnerships, and business development.

Paul continues to support Avertium as an Advisory Board Member, focused on brand ambassadorship, adversary intelligence, and security industry trends. Prior to Avertium, Paul was the Co-Founder and CEO of TruShield Security Solutions, which was acquired by Sunstone Partners as one of the founding companies of Avertium

His foundation in the finance industry gave him first-hand experience in how crippling cybersecurity issues can be for individuals, businesses, and even the Federal Government. This sparked his interest in building a company where he could help clients not just understand the risks they face, but to combat them with effective mitigation strategies.

Under Paul’s leadership, TruShield earned a distinguished reputation as one of the fastest growing companies in the cybersecurity industry. Paul also serves as the Cybersecurity Advisor to the Science and Technology Policy Center for Development, where he utilizes his expertise to help the nonprofit achieve their goal of advancing ICT in developing countries.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#3 - Introducing The Adversary Toolbox: PsExec. Plus cybersecurity startup founders roundtable.

LimaCharlie — Wed, 26 Oct 2022 12:00:00 +0000

In this episode of the Cybersecurity Defenders Podcast, Matt Bromiley introduces the Adversary Toolbox and discusses Microsoft Windows remote execution tool, PsExec.

We also sit down to chat with several cybersecurity startup founders about the lessons that they learned along the way and the things they wished they had known starting out.

The panelists for this informative discussion are:

Roselle Safran, Founder and CEO of KeyCaliber
Corey White, Founder and CEO of Cyvatar
Maxime Lamothe-Brassard, Founder and CEO of LimaCharlie

If you have any suggestions or feedback please don't hesitate to reach out to us: defenders@limacharlie.io

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#2 - Hacker History: Clifford Stoll

LimaCharlie — Fri, 21 Oct 2022 14:00:00 +0000

In this episode, we are going to be recounting the Story of Clifford Stoll, who made a pretty big discovery in 1986 while working as a sys admin for the Lawrence Berkeley National Laboratory. It is a story that involves a suspected murder, international espionage, and the type of relentless curiosity that makes a great defender.

This episode was written by Nathaniel Nelson, narrated and produced by Christopher Luft.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

#1 - Introducing The Cybersecurity Defenders Podcast

LimaCharlie — Wed, 19 Oct 2022 12:00:00 +0000

The first episode of The Cybersecurity Defenders Podcast. A show about cybersecurity and the people that defend the internet.

This weekly show is put together as a series of segments. This episode includes the following:

A cybersecurity news update by Dr. Gerald Auger of Simply Cyber.
An interview with the CISO of Synoptek, Chris Gebhardt.
A product update from LimaCharlie founder Maxime Lamothe-Brassard.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.