ShadowTalk: Powered by ReliaQuest

ShadowTalk hosts Alec, Charles, Austin, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- Mimecast confirms SolarWinds attackers breached security certificate the latest updates- The rise and fall of Emotet plus unique video footage of the takedown- NetWalker ransomware targeted and taken down by US and Bulgarian Law Enforcement - Avaddon adopts a new tactic - could it become the MO of other threat groups?- North Korean threat actors go phishing for security researchers with fake social media profilesGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-29-january ***Resources from this week’s podcast***Mimecast SolarWinds Update: https://www.mimecast.com/blog/important-security-update/ 23 Sunburst Targets Identified: https://www.netresec.com/?page=Blog&month=2021-01&post=Twenty-three-SUNBURST-Targets-Identified Emotet: https://www.zdnet.com/article/emotet-worlds-most-dangerous-malware-botnet-disrupted-by-international-police-operation/ Emotet Takedown Video: https://youtu.be/_BLOmClsSpc NetWalker: https://www.zdnet.com/article/us-and-bulgarian-authorities-dirsupt-netwalker-ransomware-operation/ Avaddon: https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/ NK Activity: https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-targeting-security-researchers-with-malware-0-days/ Ransomware 2020 Blog: https://www.digitalshadows.com/blog-and-research/ransomware-analyzing-the-data-from-2020/Also, don’t forget to reach out to - [email protected]

ShadowTalk hosts Stefano, Adam, Kim, and Dylan bring you the latest in threat intelligence. This week they cover:- Adam and the team discuss more SolarWinds updates - what’s the latest?- Kim talks CISA security advisory - trends in recent attacks and cyber hygiene- Dylan dives into new ransomware attack on IObit - how threat actors spread the malware to its membersGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-22-january ***Resources from this week’s podcast***Cryptocurrency: https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/https://twitter.com/BleepinComputer/status/1351261442536861697 Lokibot: https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html 3 Takeaways from Forrester: https://www.digitalshadows.com/blog-and-research/top-3-takeaways-from-forrester-ti-nowtech-2020/ AzureAD: https://www.digitalshadows.com/blog-and-research/azure-ad-auto-validate-exposed-credentials/Asset and Wealth Management: https://www.digitalshadows.com/blog-and-research/threats-to-asset-and-wealth-management-in-2020-2021/ Also, don’t forget to reach out to - [email protected]

ShadowTalk hosts Alec, Charles, Austin, and Ivan bring you the latest in threat intelligence. This week they cover:- Significant updates to the SolarWinds incident- Overlaps of the "Sunburst" backdoor and malware known to be used by the believed Russia-affiliated APT "Turla"- Possible SolarWinds scam - SolarLeaks claiming to sell data stolen in SolarWinds attacks- The newly identified Sunspot malware- Mimecast reporting of a compromised certificate possibly related to SolarWinds - the team dives deeper- DarkSide ransomware decryptor keys being released and how DarkSide respondedGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-15-january ***Resources from this week’s podcast***Sunburst: https://securelist.com/sunburst-backdoor-kazuar/99981/SolarLeaks: https://www.bleepingcomputer.com/news/security/solarleaks-site-claims-to-sell-data-stolen-in-solarwinds-attacks/SolarWinds updates: https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/ https://www.cyberscoop.com/mimecast-email-breach-solarwinds-russia/?category_news=technology Sunspot: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/Covid-19 threat landscape updates: https://www.digitalshadows.com/blog-and-research/targets-and-predictions-for-the-covid-19-threat-landscape/Dark Web Marketplaces And Cybercriminal Forums: https://www.digitalshadows.com/blog-and-research/tracing-dark-web-marketplaces-and-cybercriminal-forums/ ShadowTalk Email: [email protected]

ShadowTalk hosts Stefano, Kim, Adam, and Dylan bring you the latest in threat intelligence. This week they cover:- Post-holiday updates on SolarWinds - what have we missed? - Ticketmaster gets fined $10 million for illegally accessing the internal systems of a competitor, using the credentials of a former employee- Apex Laboratory announced that it was the victim of a cyber attack - what we know so far- 2020 in review: What will the new year bring in the world of cyber security?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-08-january ***Resources from this week’s podcast***SolarWinds:https://www.solarwinds.com/securityadvisorySolarWinds Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-what-security-teams-need-to-know/ SolarWinds Update Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-update/ TicketMaster Fraud: https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0APT27: https://www.scmagazine.com/home/security-news/ransomware/chinese-espionage-group-apt27-moves-into-ransomware/ 2020 Lookback Blog: https://www.digitalshadows.com/blog-and-research/lookingback-at-2020/ 2021 Forecasts Blog: https://www.digitalshadows.com/blog-and-research/2021-forecasts/ ShadowTalk Email: [email protected]

ShadowTalk hosts Kacey, Charles, Alec, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover all things SolarWinds:- An overview of the campaign and event timelines- SolarWinds' SEC filing and its implications- Early indicators of compromise, including public FTP creds and an access listing- What we can expect from this attack as time goes onGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-18-december ***Resources from this week’s podcast***Microsoft: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/SolarWinds:https://www.solarwinds.com/securityadvisoryFireEye: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.htmlDomainTools: https://www.domaintools.com/resources/blog/unraveling-network-infrastructure-linked-to-the-solarwinds-hack?utm_source=Social&utm_medium=twitter&utm_campaign=SUNBURST#FTP Creds (2019):https://savebreach.com/solarwinds-credentials-exposure-led-to-us-government-fireye-breach/ SEC Filinghttps://portal.pannus.uk/client/intelligence/incident/67083793 https://www.sec.gov/ix?doc=/Archives/edgar/data/1739942/000162828020017451/swi-20201214.htm Dark Halo: https://portal.pannus.uk/client/intelligence/incident/67128769https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/SolarWinds Blog: https://www.digitalshadows.com/blog-and-research/solarwinds-compromise-what-security-teams-need-to-know/

ShadowTalk hosts Stefano, Kim, and Adam bring you the latest in threat intelligence. This week they cover:- FireEye, a top security firm, suffers a breach caused by a state-sponsored attacker- Phishing campaigns target the distribution of the Covid-19 vaccine- Ransomware gangs resort to cold-calling victims in order to cash in - Plus, the very festive ‘Malware name of the week’Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-11-december ***Resources from this week’s podcast***FireEye breach: https://arstechnica.com/information-technology/2020/12/security-firm-fireeye-says-nation-state-hackers-stole-potent-attack-tools/ FireEye breach: https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html Phishing targeting the vaccine: https://portal-digitalshadows.com/search/intelligenceincident/66425527 Phishing targeting the vaccine: https://securityintelligence.com/posts/ibm-uncovers-global-phishing-covid-19-vaccine-cold-chain/ Ransomware cold calls: https://www.zdnet.com/article/ransomware-gangs-are-now-cold-calling-victims-if-they-restore-from-backups-without-payingMalware name of the week: https://www.pcrisk.com/removal-guides/10819-merry-christmas-ransomware Egregor blog: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/Holiday Cybercrime blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/ Podcast email: [email protected]

ShadowTalk hosts Kacey, Charles, and Digital Shadows CISO Rick chat with Brian Wrozek of Optiv. They cover: - Brian’s origin in cybersecurity - Looking forward to 2021 - what should we be focusing on and what do we need to be prepared for?- Threat modeling and tabletop exercises - how do we prepare for the worst?- Brian and the team talk degrees - how big of a role do they play when recruiting? ***Resources from this week’s podcast***Find Brian Wrozek on LinkedIn: https://www.linkedin.com/in/brianwrozek Find Brian Wrozek on Twitter: https://twitter.com/bdwtexas?lang=en University of Dallas link: https://udallas.edu/cob/about/adjunct-faculty/wrozek-brian.phpOptiv: https://www.optiv.com/

ShadowTalk hosts Kacey, Charles, Alec, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:- REvil ransomware breathes new life into Gootkit malware - C-level email credentials listed for sale on a cybercriminal marketplace- Does REvil have ties to Maze and Egregor? A conversation about source evaluation and attribution.- Spam Haus reports that thousands of IPV4 addresses are suddenly coming alive - is more BGP abuse on the horizon?Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-4-december ***Resources from this week’s podcast***Gootkit: https://www.bleepingcomputer.com/news/security/gootkit-malware-returns-to-life-alongside-revil-ransomware/Threat actor sells accounts: https://www.zdnet.com/article/a-hacker-is-selling-access-to-the-email-accounts-of-hundreds-of-c-level-executives/REvil: https://twitter.com/campuscodi/status/1333462999105998848Spam Haus: https://www.reddit.com/r/blueteamsec/comments/k42sk7/suspicious_network_resurrections_spamhouse/?utm_source=share&utm_medium=web2x&context=32021 Predictions blog: https://www.digitalshadows.com/blog-and-research/2021-forecasts/2021 Predictions webinar: https://info.digitalshadows.com/2020Dec09-Live-Webinar-Predictions.htmlEgregor blog: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/

ShadowTalk hosts Stefano, Adam and Dylan bring you the latest in threat intelligence. This week they cover: - QBot drops Prolock for Egregor ransomware- IoT new regulations - Black Friday threats and opportunities- Plus: The team discuss the malware name of the weekGet this week’s intelligence summary at: https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-27-november***Resources from this week’s podcast***Holiday Cybercrime Blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/Egregor: https://www.digitalshadows.com/blog-and-research/egregor-the-new-ransomware-variant-to-watch/

ShadowTalk hosts Kacey, Alec, and Charles, bring you the latest in threat intelligence. This week they cover: - New Chinese APT group, FunnyDream, conducts a sophisticated cyber espionage campaign targeting SE Asian government entities.- Ransomware operators want to be heard - Ragnar Locker turns to Facebook and Egregor begins printing ransom notes.- Is Egregor the new Maze? Let's unpack this.- Plus, the team talks about their favorite Thanksgiving dish, plus a side of footballGet this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-20-november ***Resources from this week’s podcast***FunnyDream: https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdfRagnar Locker: https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/Egregor: https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/Darkside Blog: https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/Triangle InfoSecCons - Cybercrime Trends with Digital Shadows CISO Rick: https://www.youtube.com/watch?v=owBgVgiWFXMRansomware Trends in Q3 Webinar: https://resources.digitalshadows.com/webinars/ransomware-trends-in-q3Holiday Cybercrime Blog: https://www.digitalshadows.com/blog-and-research/holiday-cybercrime-retail-risks-and-dark-web-kicks/Digital Shadows in Security Mag: https://www.securitymagazine.com/articles/93950-cybercriminal-forum-offers-wisconsin-voter-data-for-free