Adversary Universe Podcast

By CrowdStrikeNews Technology Tech News

Adversary Universe Podcast episodes

October 29 New CrowdStrike Report Spotlights Agentic AI Campaigns
How is the threat landscape looking these days? “A lot is going on,” as Adam puts it. “The speed and the volume of the activity, everything is on fire.” To illustrate, he shares the Falcon Adversary OverWatch team is now clocking a new agentic adversary every two hours.

A new report from CrowdStrike Counter Adversary Operations puts a spotlight on some of them. The team details four profiles of agentic adversaries, including their targets, operations, and sophistication. Actor 1, believed to operate out of Argentina, is the most advanced and uses a range of AI models including Claude, Sonnet, Opus, and Fable to target healthcare entities. Actor 4, the least sophisticated of the group, is likely a criminal actor operating out of Russia.

In this episode, Adam and Cristian compare and contrast these adversaries. They discuss how they built the harnesses used in their operations, how they handle rejections or guardrails built into AI agents, and how they overcome challenges. Each actor has different methodologies for dealing with the obstacles they face. They also have gaps in their operational security that allow researchers to gain a better idea of how they operate.

Tune in for all the details and check out the full report: CrowdStrike Counter Adversary Operations Uncovers New 2026 Agentic AI Campaigns.
37 min
October 16 Inside the Cyber Superintelligence Lab with CrowdStrike’s Bartley Richardson
Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, recently took the stage at Fal.Con 2026 to announce CrowdStrike’s Cyber Superintelligence Lab. The lab brings together our AI researchers, offensive operators, and incident responders to build defensive model and harness capabilities for the agentic era.

How are they doing it? “To build the best defense, you have to understand the best offense,” Bartley says.

The first initiative to come from the lab is SafeMind, a system that combines offensive and defensive security models with runtime harnesses to execute autonomous security workflows. Red Tempest, on the offensive side, emulates real adversaries targeting live virtual machine (VM) environments. The CrowdStrike Falcon® sensor takes this telemetry and feeds it into Blue Solano, the defensive environment, to improve it. The fortified defensive model then faces Red Tempest again.

“We wanted to build the best defensive capability that would auto-patch, auto-remediate, auto-deliver content, to work inside of environments,” Bartley explains in this episode, which goes far beyond SafeMind.

Tune in to hear Bartley, Adam, and Cristian dig into the AI advantages for adversaries and defenders, scaling cyber defense in the enterprise, and their predictions for the future of AI.
41 min
September 24 China’s 15th Five-Year Plan: What You Need to Know
Over the past several decades, China’s five-year plan has provided a roadmap to the country's innovation and economic growth. It details what China is interested in, where technology is evolving, and what it plans to target, including the highest-priority verticals.

“It’s their shopping list,” as Adam puts it. His team does a deep analysis on these plans, including information published adjacent to it and the discrepancies across various languages.

The latest five-year plan, published in March 2026, reveals a strong emphasis on a wide range of industries: academia, aerospace, biomedical, defense, and energy. It also reveals new areas of focus: AI-enabled robots, integrated chips, and innovation in advanced circuitry design. As China strives for global technological influence, integrating AI into every industry is essential.

Tune in to hear Adam and Cristian discuss the details of China’s latest five-year plan, the reasoning behind making this information public, how the plan enables cyber contractors competing for government projects, and how China’s strategic focus on key industries and AI development is poised to shape the geopolitical and cybersecurity landscapes.
32 min
September 10 Preparing for an AI-Powered Future with Amazon CSO Steve Schmidt
Steve Schmidt, SVP and CSO at Amazon, sees firsthand how both defenders and adversaries are using AI to their advantage. In this episode, he joins Adam and Cristian to discuss modern AI models, evolving adversary behavior, and how Amazon is responding to shifts in the threat landscape.

“The big change we’ve seen recently is the ability of models to chain things together to produce something interesting,” Steve says. As AI models grow more adept at automatically chaining and acting, he adds, the time to respond has dramatically decreased.

Defenders must now measure and respond in seconds or minutes, when they used to have hours or days. In using AI to fight AI-driven attacks, they must also consider which AI models they’re using. Using the right model is essential. If the business is building defenses for Mythos or Fable, and the adversary is using a different technology, the threat model changes.

While adversarial use of AI is a primary concern, right alongside it is employees’ use of AI. As Steve puts it, to build a good AI governance program, defenders need strong identity governance and data governance programs. The identity component is key. Many organizations over-permission agents; others are so restrictive they defeat the purpose of having agents at all.

How did Amazon handle this? Steve shares how the company built its own authentication framework that treats agents as a third type of identity. The agent temporarily inherits permissions through session-based delegation from the human who deployed it; it can only access what that person can access. It can’t do what they can’t do, even if a malicious prompt tries to trick it.

Tune in to hear more details about AI-driven defense, and the evolution of AI-powered offense, in this episode of the Adversary Universe podcast.
38 min
August 13 AI as a Weapon, Target, and Enterprise Reality with CoreWeave’s Natasha Eastman
“What are these AI systems attached to that make them such a huge risk?”

“Everything.”

Today, the Adversary Universe podcast welcomes Natasha Eastman, head of threat intelligence at CoreWeave, to share her perspective on how AI is used in the modern enterprise, the infrastructure needed to support it, and how she sees adversaries both using and attacking it.

AI hasn’t necessarily given adversaries wholly new capabilities, Natasha explains. It enables them to do things faster, more capably, and with a lower barrier to entry. AI is seen in phishing scams, recon, coding and tooling support, fraud, and language and persona operations. It’s allowing threat actors to refine their content and make phishing even harder to detect.

When it comes to attacks on AI, supply chain compromise and identity targeting are top of mind. Depending on how agents are configured and who configured them, they can have a phenomenal amount of access to internal and external resources. An attacker who gains control of an employee or agent identity could have unrestricted access to company systems and resources without the right guardrails in place. Our hosts and guest agree: It’s the new insider risk.

“Everyone’s infrastructure that has access to AI capability is a target,” Natasha says.

Tune in to hear Adam, Cristian, and Natasha pool their observations on AI threats, share what concerns them most, and offer their advice on what makes a strong AI governance program.
43 min
August 03 Unpacking the CrowdStrike 2026 Threat Hunting Report with CrowdStrike’s Katie Blankenship
The CrowdStrike 2026 Threat Hunting Report is now live! The report sheds light on how our threat hunters and analysts hunt and defend against the world’s most sophisticated adversaries. It’s packed with stories from the front lines and trends that define the modern threat landscape.

Joining Adam to dig into its findings is Katie Blankenship, Sr. Director of the Global Threat Analysis Cell for the CrowdStrike Counter Adversary Operations team. Katie, who leads the charge for our major intelligence reports, explains the herculean effort that goes into distilling a year’s worth of events into a single report. The CrowdStrike 2026 Threat Hunting Report is the product of seven trillion events analyzed, 14 million daily detection leads, and 36,000 annual customer alerts and notifications.

So what did they tell us? These are some key takeaways covered in this episode:

The window between vulnerability disclosure and exploitation is collapsing. From January through June 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a public proof of concept (PoC) was conducted within 48 hours of the PoC’s release. China-nexus adversaries VAULT PANDA and GENESIS PANDA, both highly active in the last six months, are monitoring vulnerability disclosures so they can quickly weaponize them.

Adversaries are targeting the developer ecosystem. Software supply chain attacks aren’t new, but adversaries are seeing opportunities to exploit trust relationships in this pipeline. ALTERED SPIDER is one of them — this adversary compromised 300+ software dependencies in one day, harvested credentials, and pivoted into cloud environments.

Technology and finance are in the crosshairs. Technology was the most targeted sector for the ninth year running. DPRK-nexus adversary FAMOUS CHOLLIMA’s operations accounted for 55% of all state-sponsored intrusions targeting this sector. The financial services sector saw an 11% year-over-year increase in targeting, with FAMOUS CHOLLIMA driving activity there as well.

Tune in to hear Adam and Katie discuss the CrowdStrike 2026 Threat Hunting Report’s most interesting stories, stats, and adversaries in an episode that Adam calls “the podcast for those who didn’t want to read the 48-page report.”

Methodology & Source: All information provided is based on the CrowdStrike Counter Adversary Operations team’s proprietary threat intelligence gathered between July 1, 2025, and June 30, 2026. Stats may include data from the entire period surveyed or excerpts of data from specific date ranges within the period.
33 min
July 09 SaaS Security Threats to Worry About, with Salesforce’s Kelly McCracken
Kelly McCracken, SVP of the Cyber Security Operations Center at Salesforce, leads one of the most complex and high-scale cyber operation environments on the planet. Today, she joins Adam and Cristian to discuss how adversaries are targeting SaaS vendors, the most underappreciated SaaS misconfigurations, and what the future of the shared responsibility model looks like.

SaaS is a continuously growing target, but who is taking aim? eCrime adversaries such as SNARKY SPIDER and CORDIAL SPIDER are ones to watch, Adam says. They take advantage of poorly secured identities that make for lucrative targets. If a threat actor can log in as a legitimate user and gain access to a SaaS environment, they can reach any range of applications with poor security configurations — and exfiltrate their sensitive data.

The shared responsibility model is essential to defense. Businesses must understand what their vendors are responsible for securing and what they’re responsible for securing. A lack of configurations and policies opens the door to both external adversaries and insider threats.

“I feel like most security teams are flying blind when it comes to what’s going on with some of the most precious data for their company,” Kelly says.

Tune in for a deep-dive conversation on one of the most prominent threats facing businesses today and stick around to hear about Cristian’s latest culinary fail and Kelly’s elite Latin skills.
37 min
June 25 Examining the Glassworm Takeover with Tillmann "Bot Slayer" Werner
He’s back, and he’s ready to talk botnet takeovers.

Tillmann Werner, VP of Intelligence Production at CrowdStrike, returns to the podcast to discuss CrowdStrike’s coordinated takeover of the Glassworm botnet. Glassworm was a global threat targeting software developers through the open-source supply chain. This infection vector stood out — open-source ecosystems are based on trust, and adversaries are learning they can reach a vast pool of victims by compromising the supply chain. Some open-source libraries get 100 million downloads per week.

Glassworm was described as an “unkillable” botnet. Resilience was built into its design, which relied on four different command-and-control channels. This made the takeover complicated because a botnet can’t be taken over until all command-and-control mechanisms are suppressed.

“Once it’s down, you gotta make sure it’s down,” said Adam, who calls Tillmann the “bot slayer.”

In this episode, they get into the details: what Glassworm was after, how its unknown operators strengthened its infrastructure, and the planning and execution behind the takeover. Tillmann and his team facilitated the process by conducting extensive technical analysis, understanding Glassworm’s evolution, and spotting the opportunity to disrupt it. They worked with partners across the private and public sectors, as well as internally at CrowdStrike, to do it safely and avoid disrupting critical systems.

Come for the behind-the-scenes details, and stay for the debate around baking the perfect pizza in this episode of the Adversary Universe podcast.

Learn more in our blog: https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/.
39 min
June 09 China Targets Technology to Steal AI Capabilities It Can’t Build
The technology sector is the most targeted in the world by eCrime and state-sponsored threat actors. Between April 1, 2025, and March 31, 2026, China-nexus adversaries drove more than 58% of state-sponsored interactive intrusions against the sector, creating the greatest intelligence collection threat to tech companies.

These threat actors are escalating espionage against tech businesses to steal the AI capabilities and intellectual property they can’t build fast enough on their own. Adversaries such as MURKY PANDA, MUSTANG PANDA, OVERCAST PANDA, SUNRISE PANDA, and WARP PANDA targeted the tech sector more than any other industry. And China isn’t alone — Democratic People’s Republic of Korea (DPRK) adversaries also have their sights set on tech.

The CrowdStrike 2026 Technology Threat Landscape Report, now live, sheds light on how nation-state and eCrime adversaries are targeting this critical industry. From FAMOUS CHOLLIMA’s IT infiltration campaigns to eCrime adversaries accelerating extortion, there is a broad range of threats that tech organizations must prepare for.

Modern tech companies are creating the world’s most valuable and targeted assets, and their cutting-edge innovations represent both competitive advantage and greater risk. Tune in to learn the report’s key takeaways and hear Adam and Cristian dive into the report’s findings.
44 min
May 18 Adversaries Follow the Money: The CrowdStrike 2026 Financial Services Threat Landscape Report
The CrowdStrike 2026 Financial Services Threat Landscape report is now live! Adam and Cristian are here to break down the trends and techniques affecting an industry that has become a major target for adversaries.

Financial services is the fourth most-targeted industry as of Q1 2026 and accounts for 12% of all observed adversary activity. eCrime adversaries target the industry for financial gain. MUTANT SPIDER, the most active eCrime threat in the past 12 months, is tied to several intrusions in which they sell access to ransomware groups. The Democratic People’s Republic of Korea set its sights on cryptocurrency and fintech entities to steal funds for its military programs.

While financial gain may seem the obvious goal in targeting financial services, it’s not the only one. Nation-state adversaries in China, Iran, and Russia launched operations against the sector for intelligence collection. Hacktivists conducted DDoS campaigns and data breach operations, primarily driven by ideological conflicts.

Even if you don’t work in the financial services sector, you most likely work with it — consumer banks, credit card companies, insurers, payment processors, and related businesses are all part of everyday business and personal life. Tune in to hear which adversaries are targeting them and why, which regions are in the crosshairs, and how companies should defend themselves. And stick around to hear about Adam’s foray into ice cream cakes.
31 min

About Adversary Universe Podcast

From the publisher's feed

Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you…