Microsoft Threat Intelligence Podcast

By MicrosoftBusiness Technology

Microsoft Threat Intelligence Podcast episodes

March 19, 2025The Professionalization of the Ransomware Criminal Ecosystem
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by ransomware experts Allan Liska from Recorded Future and Jonathan Braley, Director of Threat Intelligence for IT-ISAC, to get a pulse check on the current state of ransomware.

They discuss how ransomware has shifted from simple attacks, like Locky, to more sophisticated, high-stakes campaigns targeting entire networks and demanding millions of dollars. Allan and Jonathan also highlight the rise of ransomware-as-a-service, the emergence of big game hunting attacks, and the increasingly professionalized criminal ecosystem surrounding ransomware. The conversation further explores the psychological aspects of cybercrime, focusing on the mindset of ransomware operators—particularly in Eastern Europe and Russia—where the line between crime and business can often be blurred.

In this episode you’ll learn:
Why attackers now target entire networks instead of just single machines
How cybercriminal groups turned ransomware into a profitable business model
The unique challenges healthcare employees face during ransomware attacks
Findings from IT-ISAC's recent ransomware reports
Some questions we ask:
How did the Colonial Pipeline attack lead to real-world actions?
Will paying the ransom restore the organization's data and operations?
What are the differences between ransomware from 10-12 years ago and ransomware today?
Resources:
View Allan Liska on LinkedIn
View Jonathan Braley on LinkedIn
View Sherrod DeGrippo on LinkedIn
IT-ISAC Ransomware report
Food and AG-ISAC Ransomware report
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
41 min
March 06, 2025Malvertising Campaign Leads to Info Stealers Hosted on Github
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Senior Microsoft Security Researcher Kajhon Soyini to explore the Luma Stealer cryptocurrency mining campaign targeting individual computers as part of a large-scale malvertising campaign. They discuss the sophisticated attack chain, which includes DLLs, clipboard malware, process injection via Explorer.exe, and how this impacted nearly one million devices around the globe.
Kajhon explains how attackers use registry modifications, WMI event consumers, and obfuscation techniques like non-standard ports and reverse shells to maintain persistence and evade detection. The duo also covers Microsoft's defense efforts and the challenges of tracking down the origins of these attacks.

In this episode you’ll learn:
Why the attack chain incorporates legacy malware like NetSupport RAT
The overlap between the Luma Stealer and Donarium malware families
How Luma Stealer uses GitHub repositories and redirector networks to deliver malicious payloads
Some questions we ask:
Can you explain how the malware uses the “image file execution objects” registry path?
What role does Netcat play in this campaign’s command and control?
Why do people still mine cryptocurrency today, with all the complexities and attack methods?
Resources:
View Kajhon Soyini on LinkedIn
View Sherrod DeGrippo on LinkedIn
Connect with Sherrod and the team at RSAC

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
36 min
February 19, 2025A Blizzard Is Impacting NATO and Ukraine – The Latest on Russian Cyber Threats
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by two Microsoft security researchers to analyze the latest Russian nation-sponsored cyber threat activity. They discuss how Russian threat actors—collectively referred to by Microsoft with the Blizzard suffix—are primarily targeting Ukraine and NATO member states, focusing on espionage, influence operations, and cyber disruption. The conversation covers Russia’s reliance on cybercrime infrastructure, the vulnerabilities of academic and IT supply chains, and the evolving tactics of groups like Secret Blizzard and Seashell Blizzard.

In this episode you’ll learn:
Why 90% of Russian cyber-attacks target Ukraine and NATO member states
How Russian threat actors exploit academic identities to infiltrate government networks
The role of cybercriminal marketplaces in supplying tools and access to nation-state actors
Some questions we ask:
How does Secret Blizzard leverage infrastructure from other threat groups?
Is there evidence of collaboration between different Russian cyber groups?
Why is identity security such a critical factor in cyber defense?
Resources:
Attending RSAC? Connect with Sherrod and Microsoft
View Sherrod DeGrippo on LinkedIn
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
24 min
February 05, 2025Microsoft’s CVP of Fraud on Combating Ecosystem Abuse
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by two expert guests to explore critical challenges in today’s evolving threat landscape.

First, Sherrod sits down with Kelly Bissell, CVP of Fraud at Microsoft, to discuss the complexities of combating fraud and product abuse. Kelly digs into the unique challenges Microsoft faces, highlighting prevalent schemes such as crypto mining, tech support scams, and the exploitation of deepfakes. Kelly also shares insights into Microsoft’s proactive approach, including recent Azure policy changes and efforts to detect and prevent fraud across its services, especially those attempting to use the compute power for crypto mining.

Later, Sherrod is joined by Priyanka Ramesha, Senior Threat Researcher on the Defender Experts team, to examine the rising risks of cloud-native attacks. They unpack why threat actors are increasingly targeting the cloud, exploiting its complexity, scalability, and common misconfigurations. Priyanka explains how attackers gain initial access through tactics like phishing, API exploitation, and OAuth abuse, and outlines their methods for credential theft, lateral movement, and data exfiltration.

In this episode you’ll learn:
What crypto mining looks like in Azure and how Microsoft detects and prevents it
The five main areas of fraud and product abuse that Microsoft focuses on
How attackers exploit the complexity and misconfigurations in cloud infrastructures
Some questions we ask:
How long do crypto mining operations run unnoticed in a customer's environment?
What changes did Microsoft make to its policy regarding crypto mining?
Why are legitimate apps sometimes compromised and used in attacks?
Resources:
View Kelly Bissell on LinkedIn
View Priyanka Ramesha on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
51 min
January 22, 2025Seashell Blizzard Ramping Up Operations and OSINT Trends of DPRK Threat Actors
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Elise Eldridge and Anna Seitz to discuss the most recent notable developments across the threat landscape.

The threat actor, also known as Sandworm or APT44, has also been observed resuming the use of the wrappers WalnutWipe and SharpWipe, and expanded the use of the Prickly Pear malware downloader.

The team highlights the geopolitical implications of these attacks, particularly in the context of Russia's influence on energy and global events. Sherrod also touches on the history of wipers in cyber operations and transitions to a discussion with Elise about trends in North Korean cyber activity, emphasizing Microsoft's ongoing efforts to analyze and mitigate these threats.

In this episode you’ll learn:
Why recent attacks have targeted the European energy sector
How Seashell Blizzard’s attacks in 2024 involved spear-phishing campaigns
Why North Korean hackers infiltrate companies through remote IT job programs
Some questions we ask:
How has Seashell Blizzard returned to using wipers, and what might explain this shift?
After sending out crafted spear-phishing emails, what happens next in the attack chain?
How might global geopolitics impact Seashell Blizzard's campaigns?
Resources:
View Elise Eldridge LinkedIn
View Anna Seitz on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
27 min
January 08, 2025Threat Landscape Update: North Korean IT Workers, OSINT, and Remote Monitoring and Management Abuse
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Caitlin Hopkins, Diana Duvieilh, and Anna Seitz to discuss the latest trends in cybersecurity threats.

The team explores OSINT observations around Remote Monitoring and Management (RMM) tools like Screen Connect by nation-state actors and reveals how they are used to deploy malware like AsyncRAT, ransomware, and execute phishing scams. They also uncover alarming tactics, such as North Korean IT workers posing as legitimate coders to infiltrate organizations, who steal cryptocurrency and use it to fund their regime. Since 2017 they have contributed to the theft of more than $3 billion.

In this episode you’ll learn:
The role of tech support scam websites in tricking victims into allowing remote access
How cybercriminal and nation-state actors are increasingly exploiting remote monitoring
Why the financial services sector is a major target for cyberattacks
Some questions we ask:
What is Screen Connect, and why is it attractive to threat actors?
How long have RMM tools been used in C2 frameworks?
Why are remote management tools being used in command-and-control systems?
Resources:
View Caitlin Hopkins on LinkedIn
View Diana Duvieilh on LinkedIn
View Anna Seitz on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
29 min
December 18, 2024Doctors’ Perspective: The Rise of Healthcare Ransomware
In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Christian Dameff and Jeff Tully, co-directors from the UCSD Center for Healthcare Cybersecurity, and contributors to our recent Healthcare Ransomware report.

They discuss their unique backgrounds as doctors and hackers, focusing on healthcare cybersecurity, and the growing risks of hospital ransomware attacks. Christian shares his journey from hacking as a teenager to combining his passion for medicine and cybersecurity, particularly the risks posed to patient safety by vulnerable medical devices. Jeff adds his perspective, highlighting the parallels between medicine and hacking, and their efforts at UCSD to bring evidence-based research to healthcare cybersecurity. The conversation explores the challenges and importance of protecting critical healthcare systems from cyber threats, aiming to improve patient safety and outcomes.

In this episode you’ll learn:
How medical device vulnerabilities reveal the impact of cybersecurity on patient care
The lack of comprehensive data on healthcare ransomware attacks
When ransomware-induced disruptions can delay life-saving procedures
Some questions we ask:
As healthcare providers, what stands out to you about ransomware in healthcare?
What does the UCSD Center for Healthcare Cybersecurity do?
What ransomware attacks are common in healthcare, and how do they differ from other industries?
Resources:
View Jeff Tully on LinkedIn
View Christian Dameff on LinkedIn
View Sherrod DeGrippo on LinkedIn

Healthcare Ransomware Report

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
43 min
December 04, 2024A Couple of Rats Pick Up New Tricks, Un Proposes Cybercrime Treaty
In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Microsoft’s Dinesh Natarajan, Senior Threat Hunter, and Thomas Ball, Senior Security Researcher. They unpack recent findings around AsyncRAT, a remote access Trojan (RAT) used for keylogging, data exfiltration, and deploying further malware.

Dinesh explains how attackers are now using screen-sharing tools, like Screen Connect, as part of a new infection chain that makes the malware delivery process more deceptive. Thomas then shares insights on SectopRAT, another threat targeting browser data and crypto wallets. Uniquely, this RAT creates a second desktop, allowing attackers to operate undetected.

Next, Sherrod talks with Microsoft’s Senior Director of Diplomacy, Kaja Ciglic, about the UN’s proposed cybercrime treaty. Originally spearheaded by Russia, the treaty aims to create a global framework for prosecuting cybercrime, but critics worry about its potential impact on freedom of expression and human rights.

In this episode you’ll learn:
How tech support scam emails lead to AsyncRAT installations on different devices
The importance of leveraging tools like Microsoft Defender's SmartScreen for protection
The treaty encourages cooperation but may let governments exploit unclear cybercrime definitions
Some questions we ask:
How does social engineering through email play a role in these attacks?
What capabilities does AsyncRat have, and why is it so concerning?
How do we ensure the treaty doesn't impact freedom of expression or human rights?
Resources:
View Dinesh Natarajan on LinkedIn
View Thomas Ball on LinkedIn
View Kaja Ciglic on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
44 min
November 20, 2024Between Two Gregs: An Update on the North Korean Threat Landscape
In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Proofpoint’s Greg Lesnewich and Microsoft’s Greg Schloemer to share the unique threat posed by North Korea’s (DPRK) state-sponsored cyber activities. The Gregs discuss their years of experience tracking North Korean cyber actors and the distinct tactics that set DPRK apart from other nation-sponsored threats. The conversation also explores North Korea’s high stakes, as DPRK threat actors operate under intense pressure from government handlers, adding a layer of urgency and fear to their operations. They share insights into North Korea’s aggressive use of stolen cryptocurrency to fund the regime’s initiatives, like ballistic missile tests, and discuss the broader geopolitical impact.

In this episode you’ll learn:
The technical sophistication and the relentlessness of DPRK cyber tactics
Complex motives behind funding and sustaining the North Korean government
The training and skills development of North Korean cyber operators
Some questions we ask:
How do North Korean threat actors set up their relay networks differently?
What sets North Korea apart from other nation-sponsored threat actors?
How do North Korean cyber actors differ from traditional e-crime actors?
Resources:
View Greg Schloemer on LinkedIn
View Greg Lesnewich on LinkedIn
View Sherrod DeGrippo on LinkedIn

Blog links:
Citrine Sleet Observed Exploiting Zero Day
New North Korean Threat Actor Identified as Moonstone Sleet
East Asia Threat Actor Technique Report

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
45 min
November 06, 2024Microsoft’s Yonatan Zunger on Red Teaming Generative AI
In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Yonatan Zunger, CVP of AI Safety and Security at Microsoft. The conversation delves into the critical role of the AI Red Team, which focuses on identifying vulnerabilities in AI systems. Yonatan emphasizes the importance of ensuring the safety of Microsoft’s AI products and the innovative methods the team employs to simulate potential threats, including how they assess risk and develop effective responses. This engaging dialogue offers insights into the intersection of technology, security, and human behavior in the evolving landscape of AI.

In this episode you’ll learn:
Why securing AI systems requires understanding their unique psychology
The importance of training and technical mitigations to enhance AI safety
How financial incentives drive performance improvements in AI systems
Some questions we ask:
How does Retrieval Augmented Generation (RAG) work?
What are the potential risks with data access and permissions in AI systems?
Should users tell language models that accuracy affects their rewards to improve responses?
Resources:
View Yonatan Zunger on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
40 min

About Microsoft Threat Intelligence Podcast

From the publisher's feed

Join us to hear stories from the Microsoft Threat Intelligence community as they navigate the ever-evolving threat landscape - uncovering APTs, cybercrime gangs, malware, vulnerabilities, and other…