Send us fan mail!

How does cybercrime threaten individual reporters? What about an entire newsroom?
What if you’re an average person who suddenly becomes the center of a dark conspiracy theory?

Welcome to the world of cybersecurity for at-risk individuals. In this episode, renowned cybersecurity expert, Runa Sandvik joins to talk about her work protecting journalists and newsrooms from powerful attackers.


Join us as we discuss the following:

• Protecting personal and corporate devices and accounts for high risk individuals
• Common security gaps found in highly targeted organizations
• Effectively using cybersecurity tools
• Communicating cybersecurity guidance in the workplace

Resources:

• https://www.reuters.com/business/media-telecom/reuters-reporters-online-accounts-faked-approach-china-activists-2023-02-28/
• https://www.nbcnews.com/tech/misinformation/tiffany-dover-conspiracy-theorists-silence-rcna69401

Send us fan mail!

A brief note on content for today's episode, we are going to be discussing or mentioning stalking, domestic abuse, and sex trafficking in today's show.

If you’re a threat actor with a million dollar budget targeting high ranked targets like dissidents, activists, journalists and politicians, how do you do it? What if you’d like to stalk your neighbor, or your ex?

In this episode, Proofpoint security research engineer, Chris Talib discusses high-ticket mobile spyware, the proliferation of low-cost stalkerware, surveillance capitalism and why he believes technology can’t solve social problems.

Join us as we discuss the following:

• Mobile spyware tools
• The impact of low cost stalkerware
• Moral and ethical implications of developing spyware
• The role of governments,organizations and activists in protecting citizen’s right to privacy

Resources:

• https://www.laquadrature.net/en/
• https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/
• https://www.forbes.com/sites/thomasbrewster/2023/04/06/sex-traffickers-use-parenting-apps-like-life360-to-spy-on-victims/?sh=110a6e2464c3
• https://www.eff.org/
• https://tacticaltech.org/
• https://defensive-lab.agency/
• https://echap.eu.org/

Send us fan mail!

At least three threat actors are ushering in a new era for IcedID, originally classified as banking malware in 2017. In this episode, Proofpoint researchers, Joe Wise and Pim Trouerbach, are here to share their research on the Lite and Forked IcedID variants

Join us as we discuss the following:

• Lite IcedID Variant
• Forked IcedID Variant
• The key differences between the variants
• Which operators the Proofpoint team hypothesizes are behind the attacks

Resources:
https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid

Send us fan mail!

In this podcast episode, Proofpoint senior threat researcher, Adam McNeil, joins us to talk about conversational SMS phishing. These campaigns target mobile devices and often start with a simple, innocuous question.

“Are you coming to dinner tomorrow?” can lead to anything from fraud to impersonation to financial schemes and is considered a $3 billion threat.
In this episode, we discuss the following:

• Why a threat actor would choose a conversational SMS campaign
• Different scams associated with conversational SMS phishing
• Lack of awareness surrounding mobile threats

Send us fan mail!

Cloud threats are a growing concern due to users' and organizations' increasing adoption of cloud computing. It's crucial to develop the skills needed to identify and analyze cloud-based threats and know the latest security tools and techniques to detect, prevent, and respond to cloud-based attacks.

Ultimately, security researchers and analysts play a critical role in helping organizations mitigate cloud-related risks and ensure the security of their cloud environments. In this episode, Eilon Bendet, from the Proofpoint cloud threat research team, joins us to discuss the cloud threats he is seeing.
In this episode, we discuss the following:

• Cloud threat Detection and landscape
• Main objectives for threat actors when they leverage the cloud
• How users and organization can best protect themselves

Additional Resources:
Cloud Threats & Cloud Threat Landscape

• https://www.proofpoint.com/us/threat-reference/casb

• https://www.proofpoint.com/us/corporate-blog/post/dont-let-cloud-threats-rain-your-parade

• https://www.proofpoint.com/us/corporate-blog/post/microsoft-office-365-attacks-circumvent-multi-factor-authentication-lead-account

• https://www.proofpoint.com/us/blog/cloud-security/proofpoint-discovers-potentially-dangerous-microsoft-office-365-functionality

• https://www.proofpoint.com/us/blog/cloud-security/proofpoint-analyzes-potentially-dangerous-functionality-microsoft-sway-enables

• https://www.proofpoint.com/us/resources/webinars/deep-dive-latest-cloud-threats-microsoft-environments

Send us fan mail!

In the cyber threat intelligence and cybersecurity world, there is a growing recognition of the value of professionals with diverse backgrounds and skillsets. While many individuals in the field come from traditional computer science or engineering backgrounds, there is also a trend of people entering the field from unexpected paths. Sarah Sabotka, Senior Threat Researcher at Proofpoint, joins us on this episode to discuss her background in animal cruelty investigations.
In this episode, we discuss the following:

• What a typical day in the life of an animal cruelty investigator looks like
• How Sarah used social engineering and open-source intelligence (OSINT) to build cases
• How non-traditional skills and experiences have translated to success in infosec

Resources:

• https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-1-968b5a8daf9a
• https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-2-d04b7a529d36
• https://www.mandiant.com/resources/blog/cti-analyst-core-competencies-framework

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Send us fan mail!

In this episode, Zydeca Cass, Senior Threat Researcher at Proofpoint, joins the show to discuss Russia-aligned threat actor TA499. Zydeca dives into what makes tracking this threat actor so unique.

Join us as we discuss:

• Who TA499 are and what they do
• What makes their activity a cyber threat others should pay attention to
• What their activity tells us about Russia-aligned groups
• How to prevent being exploited

Check out these resources we mentioned:

• https://www.proofpoint.com/us/blog/threat-insight/dont-answer-russia-aligned-ta499-beleaguers-targets-video-call-requests
• https://www.theguardian.com/world/2022/mar/21/video-released-showing-russian-hoax-call-with-uk-defence-secretary

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!

Send us fan mail!

We’ve discussed a handful of APT actors on the Discarded podcast, like Russia, Iran, China and Turkey. In this episode, we dive into the isolated world of North Korean aligned actors with Sr. Threat Researcher, Greg Lesnewich.

In this episode, we discuss the following:

• The role DPRK’s culture of isolation has played in its approach to cyber espionage
• Overview of TA444 and what makes them different in the landscape
• TA444s relationship with cryptocurrency

Resources:

• https://www.technologyreview.com/2020/09/10/1008282/north-korea-hackers-money-laundering-cryptocurrency-bitcoin/
• https://cyberscoop.com/north-korea-lazarus-group-bangladesh-bank-donald-trump-xi-jinping/
• https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds
• https://www.recordedfuture.com/north-korea-internet-tool - https://go.recordedfuture.com/hubfs/reports/cta-2020-0209.pdf

Send us fan mail!

Social engineering is a technique used by attackers to manipulate individuals into performing actions that may put their personal or sensitive information at risk. Attackers know the biggest weakness in cybersecurity is humans—and with this, leverage socially engineered phishing emails to manipulate the human psychology. In this episode, we have Dr. Bob Hausmann, Learning and Assessment Architect, joining us to discuss the psychology behind user engagement with phishing.

In this episode, we discuss the following:

• The Zone of Proximal Development
• What the Adaptive Learning Framework is
• Where ethical lines should be drawn with phishing simulations
• Psychology of social engineering in threat actor approaches

Additional resources:

• https://www.proofpoint.com/us/blog/security-awareness-training/adaptive-learning-framework-security-awareness-training
• https://www.forrester.com/report/the-future-of-security-awareness-and-training/RES178339
• https://www.ncsc.gov.uk/blog-post/telling-users-to-avoid-clicking-bad-links-still-isnt-working
• https://twitter.com/threatinsight/status/1612888307645485086
• Daniel Pink Autonomy, Mastery & Purpose: https://www.youtube.com/watch?v=rbR2V1UeB_A&feature=youtu.be
• https://www.proofpoint.com/us/blog/threat-insight/exploiting-covid-19-how-threat-actors-hijacked-pandemic
• Stay Puft Marshmallow Man: https://www.youtube.com/watch?v=2zhDfUAQSbs&ab_channel=Ghostbusters
• 2023 State of the Phish Report: Publishing on February 28, 2023 on proofpoint.com

Send us fan mail!

A new year has arrived! The 2022 threat landscape had some extremely notable activity, from Russian APT actors to Microsoft's blocking of macros. We saw a lot and can guarantee threat actors won't be slowing down in 2023 and will continue to be a major threat to organizations. In this episode, Threat Research Managers, Alexis Dorais-Joncas, Rich Gonzalaz and Daniel Blackford, join us to share their perspectives on the 2023 threat landscape. Join us as we discuss the following:

• What our experts are anticipating in 2023
• How vulnerabilities help in detection creation
• Emerging techniques that could be used by malicious actors

Additional resources:

• https://www.proofpoint.com/us/blog/threat-insight/ta453-uses-multi-persona-impersonation-capitalize-fomo
• https://www.proofpoint.com/us/blog/threat-insight/broken-dreams-and-piggy-banks-pig-butchering-crypto-fraud-growing-online

Keep up with the latest tales from the threat research trenches by subscribing to DISCARDED in Apple Podcasts, Spotify, or wherever you get podcasts. Thanks for listening!