Microsoft Threat Intelligence Podcast

By MicrosoftBusiness Technology

Microsoft Threat Intelligence Podcast episodes

January 24, 2024North Korea Threat Landscape Update
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Greg Schloemer and Matthew Kennedy. Sherrod, Greg, and Matthew discuss North Korean cyber operations, highlighting the unique aspects that set North Korea apart, emphasizing North Korea's persistence, adaptability, and the blending of APT and cybercrime elements, mainly focusing on revenue generation through activities like cryptocurrency theft. The discussion touches on the notorious Lazarus group, known for the Sony Pictures attack and WannaCry, and how their actions captured global attention. Sherrod, Greg, and Matthew also share personal insight into why they're drawn to this particular area of cybersecurity, offering listeners a unique perspective on the motivations and passions driving those at the forefront of defending our digital world.

In this episode you’ll learn:
The evolution of North Korean cyber operations
How cryptocurrency theft is used as a means to support the state
North Korea's unique approach to cyber operations and strategic evolution over time
Some questions we ask:
How much work have you put into becoming a blockchain and cryptocurrency expert?
What challenges arise in defending against these specific software supply chain attacks?
Why are you interested in working on North Korea-related cybersecurity?
Resources:
View Greg Schloemer on LinkedIn
View Matthew Kennedy on LinkedIn
View Sherrod DeGrippo on LinkedIn

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
36 min
January 10, 2024 Microsoft Ignite Special Edition
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Jeremy Dallman, Kimberly Ortiz, and Steve Ginty. Sherrod emphasizes the importance of understanding vulnerabilities before they're exploited in the wild and discusses the process of responding to security vulnerabilities, including identifying threat actors and the urgency of patch deployment, especially for vulnerabilities targeted by ransomware groups. The conversation also focuses on Security Copilot, a tool built on Microsoft's extensive threat intelligence, designed to make SOC analysts' work more accessible by providing immediate, relevant information on threats. This episode offers an insider's view on how these professionals track internal incident responses, share crucial intelligence with customers, and continuously evolve their processes to ensure swift, accurate delivery of threat intelligence.

In this episode you’ll learn:
-How collaborating with multiple MS teams enhances intel delivery
-Interaction between Microsoft Defender Threat Intelligence and Security Copilot
-Publishing actor profiles based on internal observations of techniques and procedures

Some questions we ask:
-How will the world of AI affect the role of threat intelligence?
-What are you most excited about when it comes to AI in cybersecurity?
-When do we share intel with customers, and has that process changed over the years?

Resources:
View Kimberly Ortiz on LinkedIn
View Steve Ginty on LinkedIn
View Jeremy Dallman on LinkedIn
View Sherrod DeGrippo on LinkedIn

MDTI: Now Anyone Can Tap Into Game-Changing Threat Intelligence
The Future of Security with AI
A Year in Intel: Highlights from Microsoft's Global Stand Against APTs
The risk of trust: Social engineering threats and cyber defense

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
38 min
December 13, 2023A Journey through Cyberwarcon
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Judy Ng, Mark Parsons, and Ned Moran. Together, they delve into the riveting world of Cyberwarcon, exploring the activities of threat actors such as Volt Typhoon from China and Iranian-based adversaries. Sherrod sheds light on Volt Typhoon's strategic targeting of critical infrastructure while the team elaborates on the Iranian actors' reactive and opportunistic approach to current cyber attacks. The episode unfolds with insightful discussions of sophisticated techniques like "living off the land" and the intricacies of information operations while providing a deep dive into the evolving landscape of cyber threats and intelligence.

In this episode you’ll learn:
The use of AI in the current world of cybersecurity

Why North Korean cyber activity is often referred to as Lazarus

Unique challenges and motivations for tracking APT groups
Some questions we ask:
What are some challenges when following chaotic and unpredictable threat actors?

How do you balance secondary projects like incident response and ransomware?

What motivates someone to pursue a career in APT tracking and analysis?
Resources:
View Mark Parsons on LinkedIn
View Ned Moran on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson

The BlueHat Podcast

Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
39 min
November 29, 2023Threat Landscape with Wes Drone
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft Threat Research and Intelligence Leader Wes Drone. Wes has spent five years investigating criminal and national security computer intrusions for the FBI Cyber Division. After the FBI, he helped a Fortune 25 healthcare organization mature its security operations while gaining first-hand experience in risk management. Sherrod and Wes discuss his current role at Microsoft, where he focuses on messaging and web research. They also touch on the evolving landscape of phishing attacks and the impact of ChatGPT on code writing and security.
In this episode you’ll learn:
How ChatGPT has improved code and empowered security to create better code
Why phishing attacks have evolved with new techniques and capabilities
The preferences of threat actors and their willingness to adapt
Some questions we ask:
How have ransomware attacks shifted to a broader issue for entire businesses?
Why should defenders be constantly adapting to new tactics from threat actors?
What challenges and strategies have you noticed from the existing threat landscape?

Resources:
View Wes Drone on LinkedIn
View Sherrod DeGrippo on LinkedIn
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
39 min
November 15, 2023Punching Miscreants with Jack Mott
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Jack Mott to discuss the movie "Heat" and its relevance to social engineering and threat actor psychology. They also chat about the challenges of identifying real threats in the world of information security, highlighting the need for vigilance in detecting both evident and subtle threats. The conversation revolves around the complexities of distinguishing between genuine and malicious activity and the importance of a nuanced approach to cybersecurity.

In this episode you’ll learn:
Why experimentation and new approaches in the security industry are so necessary
Microsoft's approach to handling and investigating blocked threats
The importance of an adaptive system to stay updated on evolving threats and behaviors
Some questions we ask:
Why is curiosity a crucial quality for success in the information security field?
How do you deal with making mistakes and taking risks in your work?
Why do you foster relationships and share information with other professionals?
Resources:
View Sherrod DeGrippo on LinkedIn
Microsoft Ignite Panel, The risk of trust: Social engineering threats and cyber defense

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
26 min
November 01, 2023Octo Tempest Threat Actor Profile
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft threat research experts to talk about the activities of a threat actor known as Octo Tempest (which overlaps with research associated with 0ktapus, Scattered Spider, and UNC3944) and the blog released by Microsoft threat intelligence and Microsoft incident response groups. The discussion covers various tactics, techniques, and procedures Octo Tempest employs, such as SIM swapping, SMS phishing, and living off the land rather than using traditional malware. Octo Tempest is portrayed as a highly bespoke and hands-on threat actor, often engaged in "keyboard-to-keyboard combat" and showing extreme persistence even after being detected.

In this episode you’ll learn:
Techniques used to modify email rules and evade defensive tools
The contrast between tailored attacks and automated targeted threat actors
Why organizations should separate high-privileged accounts from normal user accounts
Some questions we ask:
Is there an end game for OctoTempest, and is it always ransomware?
What is the importance of assuming the first-factor password is already compromised?
How can organizations test controls and alerting for their security posture?
Resources:
View Sherrod DeGrippo on LinkedIn
https://aka.ms/octo-tempest

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
47 min
October 25, 2023China Threat Landscape: Meet the Typhoon
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft Senior Security Researcher Graham Dietz. Graham provides intelligence-led recommendations to improve cybersecurity posture in the future. They are creating customer-ready reports and presentations incorporating threat actor attribution, threat detection and hunting guidance, and remediation recommendations. Sherrod and Graham discuss China's extensive history in cyber operations, targeting domestic and international entities, including diplomatic organizations and industrial espionage.

In this episode you’ll learn:
How patriotic hackers are thriving inside the Chinese cybercrime underground
The complexity and diversity of Chinese cyber activities
China's economic strategies and how they relate to cyber operations
Some questions we ask:
What should someone do when handed an unknown USB device by a stranger?
Why does China target organizations without staying completely hidden?
What sets China apart as an advanced persistent threat?
Resources:
View Graham Dietz on LinkedIn
View Sherrod DeGrippo on LinkedIn

Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
37 min
October 11, 2023Exploring Mobile Threats
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Christine Fossaceca. Christine is a senior mobile security researcher at Microsoft, specializing in iOS and mobile exploit development. Christine and Sherrod discuss mobile device security and privacy concerns, mainly focusing on Apple AirTags and similar tracking devices, concentrating on the potential for misuse of these devices for shady purposes, the challenges of tracking and detecting them, and steps individuals can take to protect themselves if they suspect they are being tracked. They also examine the evolving landscape of mobile security and offer practical advice for safeguarding personal information and privacy in increasingly interconnected devices.

In this episode you’ll learn:
How attackers gain access to banking apps and iCloud accounts
The privacy implications of Bluetooth trackers
Why the landscape of mobile security is constantly evolving
Some questions we ask:
What's a mobile zero day?
How can I and people listening protect themselves on their iPhones?
What common technique do fishers use to make URLs appear legitimate?

Resources:
Follow Christine on Twitter @x71n3 & @herhaxpodcast
View Sherrod DeGrippo on LinkedIn
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
49 min
October 11, 2023Incident Response with Empathy
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Matthew Zorich, a Principal Consultant with Microsoft Incident Response. Sherrod and Matt discuss his motivation for creating accessible and open-source forensics tools and resources for entry-level forensics, aiming to guide those without extensive resources. They also examine the importance of helping smaller businesses and individuals understand and practice incident response and forensics, considering the potentially devastating impact of cyberattacks on them. Matt also emphasizes the importance of knowledge sharing and practical experimentation in incident response and identity forensics to help individuals and organizations better defend against cyber threats.

In this episode you’ll learn:
The challenges of identity-based forensics
Tactics threat actors use to compromise accounts without raising suspicion
The importance of distinguishing personal and work identities when assessing threats
Some questions we ask:
Why is it important to distinguish personal and work email from a threat perspective?
How do you protect essential accounts in a large organization?
Would you consider text messages as a reliable method to enhance security?

Resources:
View Matthew Zorich on LinkedIn
View Sherrod DeGrippo on LinkedIn
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
43 min
October 11, 2023Peach Sandstorm
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Threat Intelligence Analyst Simeon Kakpovi, Intelligence Analyst Lauren Podber, and Senior Hunt Analyst Emiel Haeghebaert. In this episode, Sherrod and guests explore the evolving nature of the Iranian APT group known as "Peach Sandstorm." They discuss how they mature over time while providing valuable insights into APT actors and their evolving strategies. They discuss techniques such as password spraying and the next steps attackers take to establish persistence within the victim's environment. Sherrod also highlights Iran's unique approach to cyber operations, where they exhibit creativity and perseverance in achieving their objectives, even when they may only sometimes be the most technically sophisticated group among nation-state actors.

In this episode you’ll learn:
The contrast between APT actors and cybercriminals
How organizations can protect themselves against password spray attacks
The importance for defenders to understand the motivations and tactics of APT actors
Some questions we ask:
What is the difference between a brute force attack and a password spray attack?
How does Iran's cyber capabilities compare to those of other countries?
What are some key differences between Iran and APT actors like Russia and China?

Resources:
How Microsoft Names Threat Actors
Peach Sandstorm

View Simeon Kakpovi on LinkedIn
View Lauren Podber on LinkedIn
View Emiel Haeghebaert on LinkedIn
View Sherrod DeGrippo on LinkedIn

Peach Sandstorm
Ingredients:
- 1 ripe peach, peeled and pitted
- 1 1/2 oz Arak (a traditional Middle Eastern aniseed-flavored spirit)
- 1 oz fresh lemon juice
- 1 oz rose water
- 1/2 oz simple syrup
- A pinch of saffron strands (soaked in 1 tablespoon of warm water for 10 minutes)
- Crushed ice
- Fresh mint leaves for garnish
- Edible rose petals for garnish

Instructions:
1. In a blender, combine the peach, Arak, lemon juice, rose water, simple syrup, saffron water, and a good amount of crushed ice.
2. Blend until smooth and frosty.
3. Pour into a chilled glass.
4. Garnish with fresh mint leaves and edible rose petals.
Related Microsoft Podcasts:
Afternoon Cyber Tea with Ann Johnson
The BlueHat Podcast
Uncovering Hidden Risks
Security Unlocked
Security Unlocked: CISO Series with Bret Arsenault
Secure the Job: Breaking into Security

Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.
42 min

About Microsoft Threat Intelligence Podcast

From the publisher's feed

Join us to hear stories from the Microsoft Threat Intelligence community as they navigate the ever-evolving threat landscape - uncovering APTs, cybercrime gangs, malware, vulnerabilities, and other…