Why are "identity attacks" on the rise?

Talos Takes

Player FM - Internet Radio Done Right

28 subscribers

추가했습니다 five 년 전

Cisco Talos에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Cisco Talos 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.

Netflix Is A Daily Joke

1
Jerry Seinfeld:A Joke About The Phrase "It Is What It Is' 1:54

6일 전1:54

나중에 재생

리스트

1:54

Jerry Seinfeld jokes about the phrase "it is what it is' in his Netflix special, "23 Hours To Kill".

약 1년 전 11:29

MP3•에피소드 홈

Now more than ever, adversaries are logging in, not breaking in. They're stealing legitimate user credentials to hide undetected on a targeted network after acquiring said credentials in a variety of ways. Hazel Burton joins Jon Munshaw this week to discuss identity attacks, recommendations for avoiding them, and how QR code phishing plays into these tactics.

214 에피소드

#Tech #Cisco Talos #Security #Cyber News #Security News #Cyber Security News #Cisco #Talos #Snort #Incident Response #News Roundup #Cyber Security Week In Review

Talos Takes

Why are "identity attacks" on the rise?

Talos Takes

28 subscribers

published 약 1년 전

MP3•에피소드 홈

214 에피소드

#Tech #Cisco Talos #Security #Cyber News #Security News #Cyber Security News #Cisco #Talos #Snort #Incident Response #News Roundup #Cyber Security Week In Review

All episodes

Talos Takes

1
How cybercriminals are camouflaging threats as fake AI tool installers 17:05

14일 전17:05

나중에 재생

리스트

17:05

Chetan Raghuprasad joins Hazel to discuss his threat hunting research into fake AI tool installers, which criminals are using to distribute ransomware, RATS, stealers and other destructive malware. He discusses the attack chain of three different campaigns, including one which even tries to justify its ransom as "humanitarian aid." For the full research, read Chetan's blog at https://blog.talosintelligence.com/fake-ai-tool-installers/…

Talos Takes

1
Inside the attack chain: A new methodology for tracking compartmentalized threats 16:29

28일 전16:29

나중에 재생

리스트

16:29

Edmund Brumaghin joins Hazel to discuss how threat actors (including state sponsored attackers), are increasingly compartmentalizing their attacks i.e they're bringing in specialist skillsets from other groups to handle different aspects of the attack chain. Edmund discusses why this is happening, and the challenges this poses for defenders when it comes to attribution and reporting. He then discusses several solutions which seek to evolve traditional threat modelling, and help provide clarity to defenders. More details can be found in this blog https://blog.talosintelligence.com/compartmentalized-threat-modeling/ If you're interested in our other blog on initial access groups, that can be found at https://blog.talosintelligence.com/redefining-initial-access-brokers/…

Talos Takes

1
Follow the motive: Rethinking defense against Initial Access Groups 16:38

5 weeks 전16:38

나중에 재생

리스트

16:38

In this episode, Hazel welcomes Talos researcher Ashley Shen to discuss the evolution of initial access brokers (IABs) and the importance of distinguishing between different types of IABs. We talk about the need for a new taxonomy to categorize IABs into three types: financially motivated (FIA), state-sponsored (SIA), and opportunistic (OIA) initial access groups. This taxonomy aims to improve threat modeling and defense strategies by providing a clearer understanding of the motivations and behaviors of different IABs. For more details, check out the blog that Ashley co-authored with other Talos researchers https://blog.talosintelligence.com/redefining-initial-access-brokers/…

Talos Takes

1
Year in Review special pt. 4: How AI is influencing the threat landscape? 32:19

7 weeks 전32:19

나중에 재생

리스트

32:19

A jam packed episode of guests means a slightly longer Talos Takes for your feed today! We welcome Amy Chang and Omar Santos from Cisco, Vitor Ventura from Talos, and Ryan Fetterman from Splunk. Together, we discuss how AI isn't rewriting the cybercrime playbook, but it is turbo charging some of the old tricks, particularly on the social engineering side. We also touch on threat actor-built LLMs and where things may be headed. We then talk about how defensive strategies can leverage AI, particularly in the SOC, to increase visibility and make determinations a lot quicker. Resources mentioned in the episode: Talos' 2024 Year in Review Cisco's State of AI Security report Defending at machine speed, by Splunk…

Talos Takes

1
Year in Review special part 3: Identity and MFA attacks 22:58

8 weeks 전22:58

나중에 재생

리스트

22:58

Steven Leung from Cisco Duo joins Hazel to discuss the prevalence of identity-based attacks, why they're happening, and the various methods attackers are using to circumvent MFA (Multi-Factor Authentication), based on data in Talos' 2024 Year in Review. Topics we touch on include phishing, push spray attacks, and Adversary-in-the Middle campaigns, and throughout the episode Steven provides best practice recommendations for implementing MFA at scale, without increasing user friction. For more resources, check out the Duo blog , and Talos' 2024 Year in Review .…

Talos Takes

1
Year in Review special part 2: The biggest ransomware trends 18:41

9 weeks 전18:41

나중에 재생

리스트

18:41

Azim Khodjibaev and Lexi DiScola join Hazel to discuss some of the most prolific ransomware groups (and why LockBit may end this year very differently to how they ended 2024). They also discuss the dominant techniques of ransomware actors, where low-profile tactics led to high-impact consequences. For the full analysis, download Talos' 2024 Year in Review at https://blog.talosintelligence.com/2024yearinreview/…

Talos Takes

1
Year in Review special part 1: vulnerabilities, email threats, and adversary tooling 18:15

10 weeks 전18:15

나중에 재생

리스트

18:15

Talos researchers Martin Lee and Thorsten Rosendahl join Hazel for the first of our dedicated episodes on the top findings from Talos' 2024 Year in Review. We discuss the vulnerabilities that attackers most targeted, how this compares with CISA's list, and how to protect network devices. Given how email lures are evolving, we spend some time chatting about how the current world news cycle may play into adversary's campaign cycles. And finally we touch on how to spot signs that your own sysadmin tools may be being used against you. For the full report, head to https://blog.talosintelligence.com/2024yearinreview/…

Talos Takes

1
A blueprint for protecting major events 13:43

16 weeks 전13:43

나중에 재생

리스트

13:43

Have you ever wondered what it takes to put on a major event like a World Cup or the Olympics, and all the cybersecurity and threat intelligence that needs to be done beforehand? Today’s episode is all about that. Hazel is joined by one of our global Cisco Talos Incident Response leaders, Yuri Kramarz, who has helped some of the biggest events around the world take place securely. We chat about risk factors, focus areas such as endpoint protection, threat hunting and incident response, and what to do in the hours and minutes leading up to the event. Check out the document we mention - a full blueprint on how to protect major events: https://blog.talosintelligence.com/protecting-major-events-blueprint-october-2024-update/…

Talos Takes

1
Why attackers are using hidden text salting to evade email filters 9:59

18 weeks 전9:59

나중에 재생

리스트

9:59

In this episode Hazel chats with Omid Mirzaei, a security research lead in the email threat research team at Cisco Talos. Omid and several Talos teammates recently released a blog on hidden text salting (or poisoning) within emails and how attackers are increasingly using this technique to evade detection, confuse email scanners, and essentially try and get phishing emails to land in people’s inboxes. Hidden text salting is a simple yet effective technique for bypassing email parsers, confusing spam filters, and evading detection engines that rely on keywords. The idea is to include some characters into the HTML source of an email that are not visually recognizable. For more, head to the Talos blog…

Talos Takes

1
How to establish a threat intelligence program (Cisco Live EMEA preview) 16:01

19 weeks 전16:01

나중에 재생

리스트

16:01

It's an European takeover this week, as Hazel sits down with Talos EMEA threat researchers Martin Lee and Thorsten Rosendahl. They're heading to Cisco Live EMEA next week (February 9-14) to deliver a four hour session on how to establish a threat intelligence program. If you can't make it - here's a 15 minute version! Thorsten and Martin provide best practices for threat intelligence, the different flavors of it (tactical, operational, and strategic), and the significance of curiosity and learning from failures. If you haven't already, check out Martin's introductory course to threat intelligence in collaboration with Cisco’s Networking Academy. This course is free for all, and is intended to give an overview of the domain for someone without prior knowledge which can be used as a starting point for further study or employment.…

Talos Takes

1
Web shell frenzies, the first appearance of Interlock, and why hackers have the worst cybersecurity: IR Trends Q4 2024 13:59

20 weeks 전13:59

나중에 재생

리스트

13:59

Joe Marshall and Craig Jackson join Hazel to discuss the biggest takeaways from Cisco Talos Incident Response's latest Quarterly Trends report. This time the spotlight is on web shells and targeted web applications – both have seen large increases. There’s a brand new ransomware actor on the scene – we’ll talk about the new Interlock ransomware and how we’ve seen this group show up this quarter. Plus, Talos IR observed threat actors using remote tooling in 100% of ransomware incidents this quarter – that’s a significant uptick. For the full report head to blog.talosintelligence.com/talos-ir-trends-q4-2024/…

Talos Takes

1
Exploring vulnerable Windows drivers 15:24

22 weeks 전15:24

나중에 재생

리스트

15:24

Hazel sits down with Vanja Svajcer from Talos' threat research team. Vanja is a prolific malware hunter and this time he's here to talk about vulnerable Windows drivers. We've been covering these drivers quite a bit on the Talos blog over the last year, and during our research we investigated classes of vulnerabilities typically exploited by threat actors as well as the payloads they typically deploy post-exploitation. The attacks in which attackers are deliberately installing known vulnerable drivers only to later exploit them is a technique referred to as Bring Your Own Vulnerable Driver (BYOVD). If you're curious about this topic and the recommendations our team has to help you address vulnerable drivers in your environment, then this episode is for you. The full research can be found at https://blog.talosintelligence.com/exploring-vulnerable-windows-drivers/…

Talos Takes

1
It's the 35th anniversary of ransomware - let's talk about the major shifts and changes 23:28

27 weeks 전23:28

나중에 재생

리스트

23:28

Ransomware is 35 years old this month, which isn't exactly something to celebrate. But in any case, do join Hazel and special guest Martin Lee to discuss what happened in the very first ransomware incident in December 1989 and why IT "wasn't ready". They then discuss how ransomware evolved to become the criminal entity it is today, which involves looking back on the likes of SamSam, Maze and the emergence of crypto currencies. Plus, learn why Martin says we shouldn't feel powerless in the face of ransomware.…

Talos Takes

1
Unwrapping the emerging Interlock ransomware attack 15:02

31 weeks 전15:02

나중에 재생

리스트

15:02

Chetan Raghuprasad is our guest today as he breaks down the relatively new Interlock ransomware attack. Cisco Talos Incident Response recently observed this attacker conducting big-game hunting and double extortion attacks. Chetan talks about the initial access tactics, deployment of the ransomware encryptor, and how Interlock communicates with its victims using their “Worldwide Secrets Blog”. For the full analysis, head to https://blog.talosintelligence.com/emerging-interlock-ransomware/…

Talos Takes

1
It's Taplunk! Talos and Splunk threat researchers meet to put the security world to rights 50:38

33 weeks 전50:38

나중에 재생

리스트

50:38

What happens when two sets of threat researchers from Talos and Splunk's SURGe team meet? Aside from some highly controversial opinions and omissions about the best horror movie, the team discuss what security trends are FUD, and what's actually fearful/ most challenging at the moment. Also, what is the security industry not aware of enough, and also too aware of? Plus some thoughts on cybersecurity awareness training and how we can do better. This is a great conversation facilitated by SURGe's Mick Baccio, with Joe Marshall and Nick Biasini from Talos, and Tamara Chacon and Audra Streetman from SURGe. Catch up on all the latest and greatest threat research from our friends at SURGe at https://www.splunk.com/en_us/surge.html…