What if the next cyberattack doesn’t steal your data… but quietly prepares to break your infrastructure?

In this premiere episode of our series on Chinese threat actors, we uncover how China transformed from noisy, smash-and-grab hackers into the world’s most sophisticated cyber power—one focused not just on espionage, but on pre-positioning inside critical infrastructure.

Through a chilling real-world scenario, we explore a new kind of threat: digital landmines—subtle, invisible changes inside power grids, telecommunications networks, and industrial systems that can be triggered at any time.

You’ll learn:

• How China’s cyber strategy evolved from IP theft to operational control
• The role of the PLA’s Strategic Support Force and the “Three Dominances”
• Why recent campaigns like Volt Typhoon signal a shift to long-term persistence
• How new Chinese cybersecurity laws are reshaping the global threat landscape
• What “living off the land” means—and why it’s so hard to detect
  

This isn’t about ransomware or data breaches. It’s about access, leverage, and timing.

Because in today’s cyber battlefield, the most dangerous attack… is the one that hasn’t happened yet.

In this episode of the Cyber Resilience Brief, we shift from chaotic cybercriminals to the calculated world of Russian nation-state threat actors—breaking down the three agencies that dominate Russia’s cyber operations: the GRU, SVR, and FSB.

What many organizations mistakenly treat as a single “Russian threat” is actually a complex ecosystem of competing intelligence agencies—each with distinct goals, tactics, and operational philosophies.

• The GRU (military intelligence) acts as the sledgehammer, driving destructive campaigns like NotPetya and operating groups such as Fancy Bear and Sandworm.
• The SVR (foreign intelligence service) is the scalpel, specializing in stealth, long-term espionage, and persistent access through groups like Cozy Bear.
• The FSB (domestic security) plays a unique role—bridging the gap between nation-state operations and the cybercriminal underground, recruiting and leveraging hackers to extend its reach.
  

We also explore how FSB-linked actors use advanced social engineering and persona development, how their tactics compare to groups like Scattered Spider, and why this convergence of espionage and cybercrime poses a growing risk to organizations worldwide.

Understanding these distinctions is critical for accurate threat attribution, effective defense strategies, and cyber resilience planning.

🎧 In this episode, you’ll learn:

• The key differences between GRU, SVR, and FSB cyber operations
• How Russian intelligence agencies compete—and why that matters
• The role of cybercriminal groups in nation-state campaigns
• Emerging risks from the blending of high-volume attacks and targeted espionage
  

🔐 Whether you’re a CISO, security practitioner, or cyber threat intelligence professional, this episode will help you better understand—and defend against—modern Russian cyber threats.

Iranian cyber attacks are escalating—shifting from espionage to destructive, large-scale operations. In this episode, we break down what CISOs need to know.

Host Tova Dvorin and offensive security expert Adrian Culley analyze the latest Iranian cyber threat activity, including groups like Handala (Void Manticore) and MuddyWater (Mango Sandstorm), and how their tactics are evolving.

You’ll learn how attackers are using malwareless techniques like Microsoft Intune device wipes, blockchain-based command-and-control via Ethereum, and Telegram-driven infrastructure to bypass traditional defenses. We also explore how IRGC-linked operations are targeting critical infrastructure, including water and power systems.

Finally, we cover what this means for defenders, including why Continuous Threat Exposure Management (CTEM), Breach and Attack Simulation (BAS), and Continuous Automated Red Teaming (CART) are now critical for modern security teams.

This episode delivers a practical breakdown of the 2026 cyber threat landscape and how organizations can better prepare.

The U.S. just made its boldest move in cybersecurity in decades.

In this episode of the Cyber Resilience Brief, Tova Dvorin and Adrian break down President Trump’s 2026 Cyber Strategy—and why it signals a massive shift from reactive defense to proactive, offensive cybersecurity.

What does this mean for CISOs, security leaders, and the private sector?

We unpack the strategy’s most critical pillars, including:

• Why “checklist compliance” is officially dead
• The rise of offensive cybersecurity and adversary disruption
• How AI and agentic systems are reshaping cyber defense
• The growing mandate for Continuous Threat Exposure Management (CTEM)
• What Zero Trust and post-quantum cryptography really require in practice
• Why critical infrastructure and supply chains are now front and center
• How this strategy pulls the boardroom into cybersecurity accountability

This isn’t regulation—it’s a call to action. And for organizations that fail to validate their defenses continuously, the risks have never been higher.

If you’re a CISO, security practitioner, or executive, this episode will help you understand what’s coming—and how to prepare.

Read the full blog here: https://www.safebreach.com/blog/the-2026-white-house-cyber-strategy/

Iranian cyber operations are entering a new era.

In this final episode of our Iran cyber series, we explore how Iranian APT groups are evolving — leveraging AI, targeting supply chains, and bypassing the billion-dollar security stacks built to stop them.

Hosts Tova Dvorin and Adrian Culley break down the emerging threats shaping 2026, including:

• Autonomous malware powered by localized LLMs

• “Skeleton key” attacks targeting MSPs and IT providers

• Adversarial AI collaboration between Iran, Russia, and North Korea

• Why identity trust is collapsing in the age of deepfakes

• The role of continuous automated red teaming in modern cyber defense

The perimeter is gone.

Your weakest vendor may now be your biggest risk.

Learn how security leaders can adapt before the next generation of attacks arrives.

June 2025 marked a turning point in cyber warfare.

In this episode of The Cyber Resilience Brief, Tova Dvorin and offensive engineer Adrian Cully break down the cyber escalation that followed Operation Rising Lion — what some analysts now describe as Iran’s 12 days of cyber war.

As missiles struck Iranian strategic targets, coordinated hacktivist groups like Cyber Avengers and Handala launched psychological operations, mass SMS spoofing campaigns, and attacks targeting operational technology (OT) systems — including Unitronics PLCs used in water and industrial facilities worldwide.

The impact quickly spread beyond the Middle East. U.S. water utilities were targeted, supply chain vulnerabilities were exploited, and retaliatory cyberattacks struck financial infrastructure.

In this episode, we explore:

• How hybrid warfare is collapsing the gap between physical and cyber attacks
• The rise of state-linked hacktivist groups
• Why OT and critical infrastructure are increasingly global targets
• How adversaries exploit the IT/OT bridge to reach industrial systems
• What security leaders must learn from the June 2025 escalation
  

Cyber conflict is no longer a secondary theater — it’s where escalation begins.

Iran’s APT42 — also known as Charming Kitten or Mint Sandstorm — is redefining social engineering with generative AI, deepfake voice cloning, and long-term phishing campaigns.

In this episode of the Cyber Resilience Brief, we break down how Iranian state-sponsored threat actors are using AI-powered phishing, MFA fatigue attacks, credential harvesting, and hack-and-leak operations to target journalists, political campaigns, academics, and enterprise executives.

You’ll learn:

• How APT42 builds months-long AI-generated relationships before deploying malware
• How deepfake voice notes are being used to bypass verification
• How compromised email accounts fuel election interference and information warfare
• Why MFA fatigue and session token abuse remain critical enterprise risks
• How adversarial exposure validation (AEV) and continuous automated red teaming help security teams detect post-phishing lateral movement
  

As AI becomes agentic and scalable, social engineering attacks are evolving from mass phishing to precision psychological operations.

This isn’t just cyber espionage. It’s AI-driven influence warfare.

Stay safe. Stay resilient.

In this episode of The Cyber Resilience Brief, we break down the modern reality of Iranian cyber warfare and industrial espionage. Host Tova Dvorin and offensive security engineer Adrian Culley analyze the tactics, techniques, and procedures (TTPs) of APT33, OilRig (APT34), and MuddyWater — three of the most active Iranian state-sponsored threat actors targeting energy, aviation, manufacturing, government, and critical infrastructure.

From intellectual property theft and aerospace breaches to DNS tunneling, living-off-the-land techniques, cloud-based command-and-control (C2), and wiper malware, we unpack how these groups evolved into stealthy, high-end cyber espionage operators.

You’ll also learn how adversarial exposure validation (AEV), breach and attack simulation (BAS), and continuous automated red teaming (CART) help security leaders validate defenses against real-world nation-state threats.

If you're a CISO, security architect, threat intelligence analyst, or cyber resilience leader, this episode delivers actionable insight into defending against advanced persistent threats (APTs).

Subscribe for expert analysis on cyber resilience, exposure management, and defending against state-sponsored cyber attacks.

In Part 2 of our Russia cyber threat series, we unpack the Western cybercrime ecosystem powering Russian ransomware operations.

We examine Scattered Spider, LAPSUS$, and Shiny Hunters, and how social engineering, SIM swapping, MFA bypass, and AI-driven voice spoofing are breaching Fortune 100 companies — without zero-days.

Learn how access brokers commoditize breaches, why help desks are prime targets, and what this shift means for CISOs and security teams.

If you’re only testing firewalls, you’re missing the real risk.

Listen now to understand how modern ransomware campaigns succeed — and what your security program must test to stay ahead.

In this special bonus episode of The Cyber Resilience Brief, host Tova Dvorin is joined by SafeBreach threat research expert Adrian Culley to examine DynoWiper, a destructive nation-state wiper malware observed targeting Poland’s energy sector.

First detected in late December 2025, DynoWiper has been linked to attacks on Polish wind farms and combined heat and power (CHP) plants, signaling a shift away from financially motivated ransomware toward pure disruption of critical infrastructure.

The episode explores:

• How DynoWiper operates without command-and-control infrastructure
• Why attribution points to Russian state-linked actors, including FSB Centre 16 (Static Tundra) and GRU Unit 7445 (Sandworm)
• Why traditional, point-in-time security testing fails against internally staged attacks
• How Continuous Threat Exposure Management (CTEM) and Adversarial Exposure Validation (AEV) help organizations identify and close exposure gaps before destructive payloads are deployed
  

While activity has been observed in Poland, the tactics discussed are highly relevant to energy and critical infrastructure operators worldwide.

Cyber resilience isn’t a one-time achievement — it’s a continuous process of validation.