In episode 29 of this podcast we heard from Bill Ladd, Chief Data Scientist at Recorded Future, about the differences between the US and Chinese cyber threat vulnerability reporting systems. He pointed out the difference in speed-of-publishing between the two, with the Chinese generally being faster, as well as their conclusion that the Chinese National Vulnerability Database (CNNVD) is essentially a shell for the Chinese MSS, the Ministry of State Security. This being the case, there’s evidence that the Chinese evaluate high-threat vulnerabilities for their potential operational utility before releasing them for publication.

Since then, researchers at Recorded Future have taken another look at the CNNVD and discovered the outright manipulation of publication dates of vulnerabilities. Priscilla Moriuchi is Director of Strategic Threat Development at Recorded Future, and along with Bill Ladd she’s coauthor of their research analysis, “Chinese Government Alters Threat Database Records.” She joins us to discuss their findings, and their broader implications.

The 2018 Olympic Games in PyeongChang recently concluded, but not without attempts at disruption from cyberattackers. A major telecom and IT provider was targeted with a multi-pronged campaign to gather credentials, move laterally within networks, and destroy data. It borrows bits of code from previously known campaigns, and was an aggressive effort to spread quickly and cause maximum damage to systems.

Greg Lesnewich is a threat intelligence analyst with Recorded Future’s Insikt Group, and he joins us to provide an overview of the malware campaign named Olympic Destroyer. We’ll get technical details, as well as a sense for why attribution is notoriously difficult in cases like this, and whether or not we’re seeing evidence of a false flag operation.

Our guest today is Michael Rea. He’s a threat intelligence professional currently working at McAfee. He’s got prior experience in the US Navy, serving at sea and at shore, including positions at Cyber Command and NSA. We’ll discuss his career, how threat intelligence differs between the military and the private sector, and why it’s valuable to formalize the management of your threat intelligence requirements, how best to do that, and why that helps make IT teams more effective. He explains the importance of identifying the use case for threat intelligence, and how to best cut through marketing noise and hype to make sure your threat intelligence provider aligns with your organization’s needs.

You’d have to be living under a virtual rock to not have noticed that virtual currencies like Bitcoin have taken off, attracting investors, speculators, and, of course, criminals, all looking to profit from the enthusiasm surrounding these cryptocurrencies. Bitcoin has been the gold standard in online currency exchange for bad guys, but its surging popularity has led to recent slowdowns in transaction processing speed and increased transaction fees. This has prompted criminals to start looking elsewhere, to other virtual currencies like Dash, Monero, and Litecoin.

Andrei Barysevich is Recorded Future’s director of advanced collection, and he’s the co-author of a recent blog post titled, “Litecoin Emerges as the Next Dominant Dark Web Currency.” He’ll take us through the research from Recorded Future’s Insikt Group explaining what factors cause groups of online fraudsters to switch from one cryptocurrency to another.

Building a successful threat intelligence operation and team involves many important considerations. What are your organizations critical assets, who are your potential adversaries, and how do you best communicate with the rest of your organization to ensure your efforts are properly focused and your conclusions properly understood and implemented?
Our guest today is AJ Nash. He’s the cyber threat intelligence evangelist and manager of intelligence services at Symantec. It’s a big company, offering a diverse array of cybersecurity products and services, with some well-known brands like Norton and LifeLock, as well as threat intelligence products and services.

Our conversation covers a wide range of topics, including the foundations of intelligence and the intelligence life cycle, the challenges of moving from the military to the private sector, leadership styles, and how to be sure you’re asking the right questions when it comes to threat intelligence.