Studio 471

Artificial intelligence is a red-hot mess, filled with contradicting predictions over whether it will bring vast benefits. From a cybercriminal perspective, AI is already providing productivity gains, from reconnaissance to drafting phishing emails to help in creating scripts and code. Ashley Jess, senior intelligence analyst with Intel 471, says threat actors in 2024 developed AI tools for specific tasks, such as data exfiltration and analysis tools designed for ransomware and data extortion groups. The cost of these tools has fallen significantly since 2022, increasing their diversity as well as their availability. Threat actors are using a combination of open-source models such as Meta’s Llama and API access to others. In this Studio 471, Jess shares her insight into how AI will shape the threat landscape.

Participants:
Ashley Jess, Senior Intelligence Analyst, Intelligence Operations, Intel 471
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

The advent of cybercrime-as-a-service – where cybercriminals create tools and products for use by other cybercriminals – has revolutionized online crime, allowing it to scale and become more effective. The discussions and products in underground forums and marketplaces can give clues as to how cybercriminals are exploiting and profiting. But these markets can be sprawling. Extracting useful cyber threat intelligence about emerging threats and monitoring the rise of novel threat actors can be a challenge. Michele Campobasso completed his doctoral thesis in 2024 about these issues while at the Eindhoven University of Technology. In this Studio 471, Campobasso shares his insight into these markets and how to maximize CTI collection.

Participants:
Michele Campobasso, PhD, Eindhoven University of Technology
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Australia holds regular attack simulation exercises to test the cyber resilience of the financial services sector. These exercises, called Cyber Operational Resilience Intelligence-led Exercises (CORIE), are designed to be as realistic as possible, drawing on targeted cyber threat intelligence to create attack scenarios. By using tactics, techniques and procedures (TTPs) that match active threat groups, organizations can learn their potential weak points and improve. In this Studio 471, two experts from the cybersecurity consultancy CyberCX discuss how these exercises are developed and executed.

Participants:
Diego Silva, Technical Principal, Cyber Threat Intelligence, CyberCX
Willem Mouton, Technical Director of Adversary Simulation, CyberCX
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

In this video, learn about cybersecurity regulations and if processing CTI could become a potential legal risk. 

An increasing number of regulations in different countries and regions require data to be processed locally for privacy and national security reasons. But these regulations have potential negative impacts on cybersecurity, such as limiting the sharing of information useful for threat hunting and penetration testing. For example, Europe’s General Data Protection Regulation considers IP addresses – a common indicator of compromise – as personal data. Since 2021, Professor Peter Swire of Georgia Tech’s College of Computing has led a team that has published two papers (linked below) studying the effects of data localization on the provision of cybersecurity services. In this Studio 471, Swire discusses the regulatory environment, how it could impact the use of cyber threat intelligence and what could be done to ensure attackers don’t leverage these changes to their advantage.

Participants:
Peter Swire, Professor, Georgia Tech College of Computing
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

In this video, learn about the rise of Russian cyber crime with U.S. Department of Defense Analyst, Alec Jackson. 

At a state level, Russia is a top-tier cyber power, with capable advanced persistent threat groups. It is also the source of a significant amount of underground cybercriminal activity. That activity is a product of its strong educational systems but poor economic opportunity for IT professionals and low penalties for cybercrime, according to U.S. Department of Defense Analyst Alec Jackson who recently wrote a paper, “How the Collapse of the Soviet Union Made Russia a Great Cyber Power.” In this Studio 471, Jackson discusses how deep, institutional corruption ties Russian IT professionals, organized criminal groups and the state together and how Russia leverages this to its advantage.

Participants:
Alec Jackson, Analyst, U.S. Department of Defense
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Learn how to share threat intelligence with ISACs from Sydney Johnson to help lower the risk of a cyber attack. 

Sharing threat intelligence is crucial for helping organizations defend against current threats. But there’s always been reluctance about sharing indicators, ranging from worries about trust to revealing too much information about threats targeting an organization. Sydney Jones is Head of Threat Intelligence at CLS Group, which runs foreign exchange settlement infrastructure used by large financial institutions. In this Studio 471, she discusses how she has set up several productive programs to share threat intelligence with Information Sharing and Analysis Centers (ISACs), helping the community reduce risk.

Participants:
Sydney Jones, Head of Threat Intelligence, CLS Group
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Learn how cyber insurance policies help reduce the risk of potential financial cyber attacks with Sezaneh Seymour from Coalition Inc. 

Cyber insurance policies are a way organizations can mitigate financial risk from cyber incidents. But these types of policies are quite different from house or car insurance, and some insurers approaching these risks in unique ways. Tech-focused insurer Coalition Inc. has a team of security experts that continually monitor their clients’ attack surfaces, including informing them of critical exposed vulnerabilities and helping them remediate weaknesses. In this Studio 471, Sezaneh Seymour, a vice president and head of regulatory risk and policy at Coalition, discusses how this approach is helping to reduce risk and incidents.

Participants:
Sezaneh Seymour, Vice President and Head of Regulatory Risk and Policy, Coalition Inc.
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Learn about ransomware attacks and how to calculate the impact of an attack on an organization.  

The costs of ransomware are high, but experts struggle to calculate the true impacts due to a lack of reporting requirements. Additionally, organizations affected by ransomware often do not want to discuss incidents for many reasons, ranging from legal to reputational to the distressing effects of being held to ransom. In this Studio 471, Jamie MacColl, a research fellow with the Royal United Services Institute, discusses a recent study, “The Scourge of Ransomware Victim Insights on Harms to Individuals, Organisations and Society.” The study sought to understand the impacts of ransomware on multiple levels, from the IT people on the front line through to civil society.

Participants:
Jamie MacColl, Research Fellow, Cyber Threats and Cyber Security, Royal United Services Institute for Defence and Security
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Learn cybercrime techniques with MITRE Corporation and see how their ATT&CK framework helps them protect their systems from cybercriminal groups. 

Over the last decade, the MITRE Corporation has grown its ATT&CK framework, which is a knowledge base of adversary behaviors that can help defenders in a variety of ways. MITRE has traditionally been focused on Advanced Persistent Threat (APT) groups but has been increasingly incorporating techniques and sub-techniques into ATT&CK that are used by cybercriminal groups. In this Studio 471, Patrick Howell O’Neill, who is a Lead Cyber Operations Analyst at MITRE, discusses these changes and why ATT&CK is useful to security professionals.

Participants:
Patrick Howell O’Neill, Lead Cyber Operations Analyst, MITRE Corporation
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Diana Selck-Paulson is the lead security researcher at Orange Cyberdefense, which is a managed security services provider that serves a worldwide client base. Her background in the social sciences as a criminologist with a specific focus on cybercrime has given her unique insight in the cybersecurity challenges facing organizations. In this episode of Studio 471, we discuss two areas where Orange Cyberdefense has produced unique research in its Security Navigator 2024 report: cyber extortion and hacktivism. We tackle whether cyber extortion can be deterred and also the deeper effects of hacktivism, which can eclipse technical disruptions.

Participants:
Diana Selck-Paulsson, Lead Security Researcher, Orange Cyberdefense
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/