In this episode of ShadowTalk, host Dean Murphy, one of ReliaQuests CISO's Rick Holland and threat research teamers Colin Ferris and Gjergji Paco discuss the latest news in cyber security and threat research. Topics this week include:

• Chinese hackers breach Microsoft Cloud
• Strava App – Tracked and Killed
• Cl0p Update
• Remote Monitoring and Management Software – RMM

Resources:

• https://www.cnn.com/2023/07/11/europe/russian-submarine-commander-killed-krasnador-intl/index.html
• https://www.telegraph.co.uk/news/2023/07/11/russian-submarine-commander-shot-strava-krasnodar-vinnytsia/
• https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_1_1_yamashige-nakatani-tanaka_en.pdf
• https://www.reliaquest.com/blog/clop-leaks-first-victims/
• https://www.cisa.gov/sites/default/files/2023-07/aa23-193a_joint_csa_enhanced_monitoring_to_detect_apt_activity_targeting_outlook_online.pdf
• https://www.washingtonpost.com/national-security/2023/07/12/microsoft-hack-china/
• https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/
• https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/13/fact-sheet-biden-harrisadministration-publishes-thenational-cybersecurity-strategyimplementation-plan/

In this episode of ShadowTalk, host Chris Morgan, along with Corey Carter, Jonny Elrod, Gjergji Paco, and one of ReliaQuests CISO's Rick Holland, discuss the latest news in cyber security and threat research. Topics this week include:

• Threat actors obfuscating activity through virtualization
• LockBit claim to have impacted Taiwanese semiconductor giant TSMC
• CISA identify new exploited vulnerabilities
• New critical vulnerability impacting Fortinet, FortiOS and FortiProxy SSL-VPN appliances

Resources:

• https://www.reliaquest.com/blog/virtual-machines-defense-evasion/
• https://www.bleepingcomputer.com/news/security/cisa-orders-govt-agencies-to-patch-bugs-exploited-by-russian-hackers/
• https://thehackernews.com/2023/07/alert-330000-fortigate-firewalls-still.html
• https://www.scmagazine.com/brief/ransomware/tsmc-discloses-data-breach-from-lockbit-claimed-attack-against-third-party

In this episode of ShadowTalk, host Stefano, along with Kim Bromley, and one of ReliaQuests CISO's Rick Holland, discuss the latest news in cyber security and threat research. Topics this week include:

• The SEC reportedly charging SolarWinds executives
• APT29 hunting for credentials
• Our new, shiny Annual Threat Report

Resources:

• https://www.reuters.com/technology/solarwinds-executives-receive-wells-notice-us-sec-2023-06-23/
• https://www.scmagazine.com/brief/identity-and-access/apt29-intensifies-credential-stealing-attacks
• https://www.reliaquest.com/resources/research-reports/annual-threat-report/

In this episode of ShadowTalk, host Chris, along with Dani, and one of ReliaQuests CISO's Rick Holland, discuss the latest news in cyber security and threat research. Topics this week include:

• The latest updates related to Cl0p's exploitation of MOVEit zero-day
• Killnet targeting European financial institutions
• Insights drawn from our closed sources team
• The team's observations on this years InfoSec conference

Resources:

• https://www.reliaquest.com/blog/clop-leaks-first-victims/ 
• https://techmonitor.ai/technology/cybersecurity/killnet-revil-and-anonymous-threaten-swift-with-destructive-attack-in-48-hours 

In this episode of ShadowTalk, host Chris, along with Colin and Caroline, discuss the latest news in cyber security and threat research. Topics this week include:

• The latest updates related to Clop's exploitation of MOVEit zero-day
• An overview of the Gootloader initial access malware
• Fortinet RCE CVE-2023-27997
• Ukraine's Cyber Anarchy Squad take down Infotel

Resources:

• https://www.reliaquest.com/blog/clop-leaks-first-victims/
• https://www.scmagazine.com/news/device-security/fortinet-patches-critical-rce-fortigate-ssl-vpn-appliances
• https://www.bleepingcomputer.com/news/security/ukrainian-hackers-take-down-service-provider-for-russian-banks/

In this episode of ShadowTalk, host Stefano, along with Rick, Dean, and Ivan, discuss the latest news in cyber security and threat research. Topics this week include:

• What you need to know on the MOVEit Zero-day vulnerability and the latest Cl0p updates 
• Infostealers ecosystem: most common malware, impact, and mitigation strategies
• Key insights from the latest Verizon's DBIR issue

Resources:

• https://www.reliaquest.com/blog/moveit-vulnerability-update-clop-claims-responsibility/ 
• https://www.verizon.com/business/resources/reports/dbir/

In this episode of ShadowTalk, host Chris, along with Gjergji and Ivan, discuss the latest news in cyber security and threat research. Topics this week include:

• What you need to know on the MOVEit Zero-day vulnerability
• RaidForums user's data breached
• The Buhti ransomware taking a unique approach to targeting victims

Resources:

• https://www.reliaquest.com/blog/moveit-transfer-zero-day/
• https://www.bleepingcomputer.com/news/security/new-buhti-ransomware-gang-uses-leaked-windows-linux-encryptors/
• https://www.bleepingcomputer.com/news/security/new-hacking-forum-leaks-data-of-478-000-raidforums-members/

Summary: In this episode of ShadowTalk, host Stefano, along with Kim, Rick, and Dean, discuss the latest news in cyber security and threat research. Topics this week include:

• An investigation into the GootLoader malware
• The latest operation from hacktivist group Intrusion Truth
• A cyber espionage campaign conduct by Volt Typhoon
• RQ Exponent conference debrief

Resources:

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
• https://www.washingtonpost.com/politics/2023/05/15/they-dox-chinese-hackers-now-theyre-back/

In this episode of ShadowTalk, host Chris Morgan , along with Caroline Fenstermacher and Gjergji Paco, discuss the latest news in cyber security and threat research. Topics this week include:

• Revisiting the SocGholish malware distribution framework 
• Getting pricked by the Cactus ransomware
• Greatness Phishing-as-a-service 

Resources:

• https://www.reliaquest.com/blog/socgholish-fakeupdates/
• https://thehackernews.com/2023/05/new-ransomware-strain-cactus-exploits.html
• https://www.bleepingcomputer.com/news/security/new-greatness-service-simplifies-microsoft-365-phishing-attacks/

Summary: In this episode of ShadowTalk, host Stefano, along with Caroline and Colin, discuss the latest news in cyber security and threat research. Topics this week include:

• Five Eyes agencies takedown FSB-linked Snake malware
• Hunting Kubernetes for privilege escalation techniques
• Investigation offers insights into Caffeine PhaaS platform

Resources:

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
• https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms
• https://www.bleepingcomputer.com/news/security/caffeine-service-lets-anyone-launch-microsoft-365-phishing-attacks/