Out of the Woods: The Threat Hunting Podcast

By Out of the Woods: The Threat Hunting PodcastBusiness Technology

Out of the Woods: The Threat Hunting Podcast episodes

November 12, 2024S3 Ep6: Be the Bengal, Dig Into the Process
**Threat Hunting Workshop: Hunting for Discovery
November 20, 2024 | 12:00 – 1:00 PM EST
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery

**Out of the Woods: The Threat Hunting Podcast [LIVE EPISODE]
December 5, 2024 | 12:00 - 1:30 PM EST
Sign Up Here: https://intel471.com/resources/podcasts/the-ideal-outcome-the-gift-of-a-well-crafted-threat-hunt

----------

Top Headlines:
Sophos News | Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign: https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/?amp=1
Wiz Blog | Investigating 0ktapus: Phishing Analysis & Detection: https://www.wiz.io/blog/unmasking-phishing-strategies-for-identifying-0ktapus-domains?&web_view=true
FortiGuard Labs | New Campaign Uses Remcos RAT to Exploit Victims: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Cado Security Labs | GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry: https://www.cadosecurity.com/blog/guloader-targeting-european-industrial-companies

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
35 min
November 07, 2024 S3 Ep3: [Bonus Episode] Inside Cloud Security with CSA’s John DiMaria
In this bonus episode of Out of the Woods, Scott Poley sits down with John DiMaria, Director of Operations Excellence at the Cloud Security Alliance (CSA), live from the Information Security Summit in Cleveland. DiMaria discusses his pivotal role in developing CSA’s STAR (Security, Trust, Assurance, and Risk) program and shares insights on cloud security, the evolution of the STAR program, and its alignment with CSA's Cloud Controls Matrix (CCM).

They also explore the future of STAR in the AI landscape, the crucial role of shared responsibility models in cloud security, and the importance of continuous monitoring and compliance in securing cloud infrastructure. DiMaria highlights his experience and CSA's ongoing efforts to provide businesses with practical resources and tools to manage cloud and AI security risks.

Perfect for anyone looking to understand the landscape of cloud security and CSA’s impact on the field, this episode offers a deep dive into the essential frameworks guiding secure cloud practices today. Tune in for this engaging and informative conversation!

*Connect with John DiMaria: https://www.linkedin.com/in/johndimaria/

-----

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
23 min
November 05, 2024S3 Ep4: Security Beyond the Box
**Threat Hunting Workshop: Hunting for Discovery
November 20, 2024 | 12:00 – 1:00 PM ET
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery

----------

Top Headlines:
Unit 42 | Jumpy Pisces Engages in Play Ransomware: https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/
Help Net Security | Sophos Mounted Counter-Offensive Operation to Foil Chinese Attackers: https://www.helpnetsecurity.com/2024/10/31/sophos-china-defensive-operation/?web_view=true
Project Zero | From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code: https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html?m=1
The Cyber Express | HeptaX: Uncovering Cyberespionage Operations Through Unauthorized RDP Connections: https://thecyberexpress.com/heptax-cyberattack/?&web_view=true

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
40 min
October 30, 2024S3 Ep1: [LIVE] Blood, Sweat, and Threats: Carving the Perfect Threat Hunter
*Join our Threat Hunting Workshop: Hunting for Discovery*
November 20, 2024 | 12:00 - 1:00 PM ET
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery

----

In this live episode of Out of the Woods: The Threat Hunting Podcast, we dive into essential threat hunting techniques and the journey to mastering the craft.

Join us as we discuss:
Building resilience through community insights and shared resources
Practical threat hunting tips with the latest from GitHub repositories and threat actor techniques
Managing the grind and balancing detection with proactive hunting strategies
Enhancing skill sets by embracing the unknowns in the journey
Interesting Artifacts:
https://github.com/BushidoUK
https://github.com/salesforce/logai?tab=readme-ov-file#documentation
https://opensource.salesforce.com/logai/latest/intro.html
https://detect.fyi/have-you-been-keeping-up-with-your-low-confidence-detections-494c742202e4

🔗 Join our Discord to interact with us at our next live session: https://discord.gg/Ka6tsEc3

#ThreatHunting #CyberSecurity #OutOfTheWoods #Podcast
1 hr 30 min
October 09, 2024S2 Ep28: Date Your Data… Swipe Right
**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter

----------

Top Headlines:
Aqua | perfctl: A Stealthy Malware Targeting Millions of Linux Servers: https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/
Cisco Talos Blog | Threat Actor Believed to be Spreading New MedusaLocker Variant in Europe and South America: https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/?&web_view=true
Proofpoint US | Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware: https://www.proofpoint.com/us/blog/threat-insight/security-brief-royal-mail-lures-deliver-open-source-prince-ransomware
Security Affairs | Kyiv's Hackers Launched an Unprecedented Cyber Attack on Russian State Media VGTRK on Putin's Birthday: https://securityaffairs.com/169486/cyber-warfare-2/kyivs-hackers-hit-russian-state-media.html?web_view=true

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
35 min
October 01, 2024S2 Ep27: iCUP… Let's Talk Hygiene
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection

**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter

----------

Top Headlines:
The Hacker News | Critical Linux CUPS Printing System Flaws Could Allow Remote Command Execution: https://thehackernews.com/2024/09/critical-linux-cups-printing-system.html?m=1
The DFIR Report | Nitrogen Campaign Drops Silver and Ends With BlackCat Ransomware: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
Netskope | DCRat Targets Users with HTML Smuggling: https://www.netskope.com/blog/dcrat-targets-users-with-html-smuggling
CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments: https://www.cisa.gov/sites/default/files/2024-09/FY23_RVA_Analysis_508.pdf

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
42 min
September 24, 2024S2 Ep26: WHOIS, or Not WHOIS…
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection

**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter

----------

In this episode of Out of the Woods: The Threat Hunting Podcast, Scott Poley and Tom Kastura explore the latest threat-hunting insights, starting with UNC 2970, a North Korean-linked group using trojanized PDF readers to target industries like energy and finance. They discuss how the group's phishing tactics exploit job openings and the use of telemetry to detect malicious activity. The episode also covers a campaign leveraging CAPTCHA pages to deliver the Luma Stealer malware and dives into the risk of poisoned Python packages compromising supply chains. Tune in for strategies to stay proactive against advanced threats and enhance your hunting techniques.

Top Headlines:
Unit 42 | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors: https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/?web_view=true
CloudSEK | Unmasking the Danger: Lumma Stealer Malware Exploits Fake CAPTCHA Pages: https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages?&web_view=true
Google Cloud | An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-reader
DarkReading | For $20, Researchers Seize Part of Net Infrastructure: https://www.darkreading.com/cyber-risk/researchers-seize-internet-infrastructure-for-20?&web_view=true

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
39 min
September 09, 2024 S2 Ep25: Bad Extensions Level Up, Social Engineering Gets Social
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection

In this episode of Out of the Woods: The Threat Hunting Podcast, Scott and Lee discuss four key topics: North Korea’s social engineering attacks on the crypto industry, the rise of the malicious Chrome extension Luma C2 Stealer, a phishing and doxxing campaign by Russian threat actors targeting NGOs, and hacktivist attacks on Russian and Belarusian institutions using ransomware and common tools. They highlight the growing sophistication of these tactics and stress the importance of vigilance and proactive threat hunting to defend against these increasingly complex threats.

Top Headlines:

1. FBI | Public Service Announcement - North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks: https://www.ic3.gov/Media/Y2024/PSA240903
2. Cybersecurity News | Beware the Drive-By Download: LummaC2 Stealer and Malicious Chrome Extension Wreak Havoc: https://securityonline.info/beware-the-drive-by-download-lummac2-stealer-and-malicious-chrome-extension-wreak-havoc/?&web_view=true
3. The Hacker News | North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams: https://thehackernews.com/2024/09/north-korean-threat-actors-deploy.html
4. SecureList | Head Mare: Adventures of a Unicorn in Russia and Belarus: https://securelist.com/head-mare-hacktivists/113555/

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
36 min
September 03, 2024 S2 Ep24: Basic Techniques Used in Advanced Ways
In this episode of "Out of the Woods: The Threat Hunting Podcast," Scott and Tom dive into the latest threat hunting headlines for the week of September 2nd, 2024. They explore how basic techniques are being repurposed in advanced ways, such as using Google Sheets for command and control in a suspected espionage campaign and employing web dev to enhance phishing attacks. The discussion also covers a new wave of skimming attacks targeting e-commerce sites and a deep dive into APT32’s advanced persistence tactics in a long-term intrusion. Scott and Tom offer insights and strategies for threat hunters to detect and counter these evolving threats.

Top Headlines:

1. Huntress | Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders: https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders?&web_view=true
2. Objective-See | A Surreptitious Cryptocurrency Miner in the Mac App Store?: https://objective-see.org/blog/blog_0x2B.html
3. Malwarebytes | Hundreds of Online Stores Hacked in New Campaign: https://www.malwarebytes.com/blog/news/2024/08/hundreds-of-online-stores-hacked-in-new-campaign?web_view=true
4. Proofpoint US | The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers "Voldemort": https://www.proofpoint.com/us/blog/threat-insight/malware-must-not-be-named-suspected-espionage-campaign-delivers-voldemort

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
37 min
August 27, 2024 S2 Ep23: Unique Executions... How Unique Are They?
In this episode of the "Out of the Woods Threat Hunting Podcast," Scott and Tom break down the top threat hunting stories for the week of August 26, 2024. They dive into SetXP, a stealthy Linux malware that manipulates UDEV rules to evade detection, and explore why it’s not yet on the MITRE ATT&CK radar. The duo also covers PeakLight, a new memory-only dropper, and Stick Stealer, a malware targeting browser data and crypto wallets. Wrapping up with insights from a BlackSuit ransomware breach, they discuss how attackers often reuse old techniques in new ways. This episode challenges the notion of what truly makes an execution unique, offering practical tips for staying ahead of evolving threats.

1. AON | Unveiling "sedexp": A Stealthy Linux Malware Exploiting udev Rules: https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp
2. The DFIR Report | BlackSuit Ransomware: https://thedfirreport.com/2024/08/26/blacksuit-ransomware/
3. Check Point Research | Unmasking Styx Stealer: How a Hacker’s Slip Led to an Intelligence Treasure Trove: https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/
4. Google Cloud Blog | PEAKLIGHT: Decoding the Stealthy Memory-Only Malware: https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?&web_view=true

Stay in Touch!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Discord: https://discord.gg/DR4mcW4zBr
TikTok: https://www.tiktok.com/@cyborgsecinc
41 min

About Out of the Woods: The Threat Hunting Podcast

From the publisher's feed

Intel 471's podcast with a twist! Join us for the first fully interactive threat hunting podcast where you can hang out with threat hunters from all over the world!