Threat Talks - Your Gateway to Cybersecurity Insights

Citrix left customers exposed to two live zero-days for three and a half weeks. Rob Maas sits down with ON2IT CTI specialist Lars Nobelen to break down how attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler appliances, why a single log injection bug let them run arbitrary commands, and what actually stopped the attacks before the patch ever arrived.

• (00:00) - Cold open: three and a half weeks without a patch

• Anatomy of the two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) and the log injection technique behind them
• Why exploitation outpaced the patch timeline by over three weeks, and what that gap cost defenders
• How SSL/TLS inspection on the firewall blocked exploitation attempts before a patch was available
• Why Citrix's own indicator-of-compromise script could miss an active web shell
• Lessons for any edge device: disabling unused features, network segmentation, and inbound decryption

Related ON2IT Content & Referenced Resources

• Threat Talks – Citrix NetScaler: Does Remote Work (2024): https://threat-talks.com/citrix-netscaler-zero-day-three-weeks-without-a-patch/ 
• CVE-2026-88771: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
• CVE-2026-88772: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
• Why SSL Decryption Matters: https://www.youtube.com/watch?v=Xv_jVHVsD9w 
• NCSC.nl advisory on Citrix NetScaler: https://advisories.ncsc.nl/2026/ncsc-2026-0394.html
• Z-CERT (Dutch healthcare sector) advisory: https://z-cert.nl/actueel/nieuws/z-cert-waarschuwt-zorgsector-voor-kritieke-citrix-kwetsbaarheden

Fifteen minutes after Lars Nobelen's iPhone was stolen at a scrapyard, it was already useless to the men holding it. An hour after that, police had all three of them in custody. Lieuwe Jan Koning talks with Lars Nobelen, ON2IT's Information Security Officer, and Robbert van der Linden, Site Reliability Engineer, about the mobile device management commands that turned a stolen phone into the evidence that caught its own thief.

Key Topics Covered

• How mobile device management (MDM) locks and tracks a stolen iPhone through Apple's Lost Mode
• Why police can act on a stationary phone location but not a moving one
• The distraction technique three thieves used to steal a phone in seconds
• Zero-touch enrollment: how ON2IT devices join MDM automatically before an employee opens the box
• The MFA "chicken and egg" problem when your authenticator lives on the phone that just got stolen

Related ON2IT Content & Referenced Resources:

ON2IT (Zero Trust as a Service): https://on2it.net/
Threat Talks website: https://threat-talks.com/
Episode code for a free Threat Talks T-shirt (email to [email protected]): 100125

Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.

🔔 Follow and Support our channel! 🔔

► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...

👕 Receive your Threat Talks T-shirt https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Do first you call the police when you're hacked, or a lawyer?

In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Stan Duijf, Head of Operations at the NIS (National Investigations Special Operations) of the Dutch National Police, to break down what actually happens after a data breach. Stan reveals that only 20% of the 150+ reported Dutch data breaches each year ever reach the police, and explains why that gap puts both companies and their customers at risk.

They cover when a breach is serious enough to call the police, why paying a ransom never makes your data safe again, and what belongs in your incident response playbook before you ever need it.

• (00:00) - Cold open: when do you call the police after a hack

4. Key Topics Covered

• When a data breach is serious enough to involve the Dutch police, and why company size is not the deciding factor.
• What early, confidential police involvement makes possible, from tracing stolen bitcoin to joining ransom negotiations.
• The three reasons the Dutch police advise never to pay a ransom.
• Why informing breach victims late exposes them to scams, and what to decide in your breach playbook in advance.
• How jurisdiction works for multinational breaches, and how private citizens should report sophisticated phishing.

5. Related ON2IT Content & Referenced Resources

• Threat Talks – Previous episode with Stan Duijf on the NIS and high-tech crime: https://youtu.be/KL39OfLoDcY
• ON2IT (Zero Trust as a Service): https://on2it.net/
• Threat Talks website: https://threat-talks.com/

6. Subscribe block

You report a breach. Does anyone ever get arrested?

Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still happen, often the moment a suspect travels.

You leave knowing why arrests are the wrong metric, what threat intel the police want from your security team, and how AI is speeding up both sides of the fight.

Timestamps

• (00:00) - Who is really on the other side of a breach

Key Topics Covered

• Why a single cybercrime investigation spans 5 to 20 countries, and what that does to response time
• Operation Endgame: a recurring, campaign-level takedown strategy against info stealers and botnets
• The broad intervention strategy: prevention, disruption, and repression, with arrests as one tool among many
• How crypto seizures work and why they matter more than the arrest count
• What threat intel the police want, and what integrated operations with companies like Microsoft, Palo Alto Networks, and Google look like

Related ON2IT Content & Referenced Resources

Threat Talks: https://threat-talks.com/
ON2IT Zero Trust MDR Prevent: https://on2it.net/
AMS-IX: https://www.ams-ix.net/ams
Operation Endgame: https://www.operation-endgame.com/
Hack_Shield / Hack_Ride, Dutch police youth offender-prevention programs: https://www.politie.nl/nieuws/2026/maart/4/11-politie-en-hackshield-werken-aan-digitale-weerbaarheid-van-kinderen.html

Subscribe block

Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.

🔔 Follow and Support our channel! 🔔

► YOUTUBE: / @threattalks
► SPOTIFY: https://open.spotify.com/show/1SXUyUE...
► APPLE: https://podcasts.apple.com/us/podcast...

👕 Receive your Threat Talks T-shirt https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR.

The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached.

So what did the M in MDR actually buy him?

Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay Area security scene, to separate what MDR vendors pitch from what MDR delivers.

Buyers think MDR is one product. It is five jobs: collect the logs, enrich them, put an experienced human in the loop, remediate, and keep it all retrievable. Most vendors do two of them well, and only inside their own stack. Three questions tell you which two. All three are in the episode, and in the description below.

Timestamps

• (00:00) - The MDR reality check: expectation versus practice

The three questions

• In practice, what does your platform do with a log it did not create? Ask for the demo on a competitor's telemetry, not your own.
• Is there tiered storage, or does every log stay hot for the life of the contract?
• When I escalate, who picks up: someone who knows my environment, or someone reading an LLM's answer back to me?

Key topics covered

• What "managed" means to different MDR vendors, and why a human in the loop is rarely part of the deal
• Why EDR, NDR, XDR and DDR all get reskinned as MDR, and what that does to scope
• The economics of vendor data lakes: every log priced as hot storage, with no tiering to warm or cold
• Commercial incentives that keep cross-vendor log support shallow, and how to test for it before you buy
• Data sovereignty and jurisdiction as a procurement requirement, not a European footnote

Related ON2IT Content & Referenced Resources:

Threat Talks: https://threat-talks.com/ ON2IT Zero Trust as a Service: https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams

Subscribe block

Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.

🔔 Follow and Support our channel! 🔔

► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...

👕 Receive your Threat Talks T-shirt https://threat-talks.com/

🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com

🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset.

Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end.

The uncomfortable part is not how clever the attack was. It is how basic it was. If your help desk resets passwords without proof of identity, if your MFA is a tap-to-approve prompt, if your users carry permissions from two jobs ago, Lapsus$ did not need to be good. They only needed to try.

Yuri and Rob also cover what actually stops this: password resets that require physical identification, hardware tokens for sensitive Protect Surfaces, privileged access management with a human in the loop, and why AI is both the fastest way to audit your permissions and the fastest way to recreate the same over-permissioning problem all over again.

Timestamps

00:00:00 Hacking the largest companies on earth is super easy 
00:01:19 Who Lapsus$ were, and why they are in jail 
00:02:25 Step one: bought credentials and a phone call to the service desk 
00:03:36 Password resets should be a hurdle, not a link 
00:06:16 Not all MFA is equal: push fatigue, SMS and SIM swapping 
00:09:03 Why your second factor does not belong in your password manager 
00:11:09 Inside the network: privilege escalation, exfiltration, extortion 
00:13:29 The fix: least privilege, PAM and a human in the loop 
00:16:05 AI as auditor, and the agentic over-permissioning problem

Key Topics Covered

• How Lapsus$ obtained initial access without a single novel technique: dark web credentials and social engineering of the help desk
• Why MFA type matters more than MFA presence, and where push approval, SMS and TOTP each break
• Privilege escalation as the real bottleneck for attackers, and what least privilege plus PAM changes
• Zero Trust Protect Surface thinking as the way to decide which control is appropriate for which data
• The AI double edge: faster permission audits on one side, over-permissioned agent service accounts on the other

Your Outlook account recovery will accept an authenticator code on its own. No password, no inbox, no phone number. 
Anyone holding that TOTP secret owns the account, and the second factor you bought to survive credential theft becomes the only thing in the way.

Koen Kandelaars found one sitting in a PDF on a public help page at the NOS, the largest news organization in the Netherlands. He scanned a QR code out of an onboarding manual and had a real employee's second factor on his phone. 

Rob Maas, Field CTO at ON2IT, walks the full chain with the attacker himself: eleven vulnerabilities in the first responsible disclosure, a twelfth Koen estimates at 1 to 5 million euros, and the recovery flow nobody tested.

Timestamps

• (00:00) - MFA was on. He got in anyway.

Key Topics Covered

• Attack surface discovery against a large public broadcaster
• Responsible disclosure done well: response time, remediation, and recognition
• Where the next generation of defenders comes from, and how they choose a side

Related ON2IT Content & Referenced Resources:

Threat Talks: https://threat-talks.com/
ON2IT (Zero Trust as a Service): https://on2it.net/
AMS-IX: https://www.ams-ix.net/ams

You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR.

Timestamps:

• (00:00) - Preemptive cybersecurity: what it means for MDR

Key Topics Covered:

• Preemptive cybersecurity as the Gartner-flagged direction, and why MDR has to move past detect-and-respond
• Turning known indicators of compromise into automated blocks at the endpoint, network, and cloud
• Collapsing the SOC and operational teams so detection and enforcement act as one
• Sub-second response, AI-driven attacks, and why MTTD and MTTR need to converge
• Data freedom and data sovereignty, and avoiding vendor cloud lock-in

Related ON2IT Content & Referenced Resources:

Threat Talks website: https://threat-talks.com/
ON2IT (Zero Trust as a Service): https://on2it.net/
AMS-IX: https://www.ams-ix.net/ams 

The new NIST Cybersecurity Framework 2.0 is out, and most teams still ask the same question: what do I do tomorrow? Lieuwe Jan Koning sits down with NIST's Amy Mahn and Daniel Elliott to turn the framework into a concrete next step. Governance is now its own function. Profiles tell you where you are and where you need to be. And the Quick Start Guides give a 15-page answer to a problem most people think needs 300 pages.

If you run security with limited resources, this episode shows you where to start and why the whole thing is free.

Timestamps

• (00:00) - The framework changed. What do you do tomorrow?

Key Topics Covered

• Why governance moved out of "Identify" and became its own function in CSF 2.0, and what that signals about cyber risk at board level.
• How organizational and community profiles turn the framework into a current-state, target-state, and gap analysis you can act on.
• Why CSF 2.0 stopped being a single PDF and became guides, spreadsheets, mappings, and search tools.
• How CSF maps to ISO 27001, SOC 2, and HIPAA so you report once instead of many times.
• Where a small business or an IT manager wearing every hat should actually begin.

Related ON2IT Content & Referenced Resources: 

NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
NIST CSF Quick Start Guides: https://www.nist.gov/cyberframework/quick-start-guides
National Cybersecurity Center of Excellence (NCCoE): https://www.nccoe.nist.gov/
NIST CSF contact: [email protected]
Threat Talks website: https://threat-talks.com/

Running a SOC was always hard. With AI in attackers' hands, hard becomes impossible, unless you change how you work. Rob Maas, Field CTO at ON2IT, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, on why detection and response no longer buys you time. Open-source AI now finds a way into a portal in about 15 minutes, no pentester required. The fix is preemptive cybersecurity: prevention first, automated countermeasures, and a zero trust culture that turns your SOC from analyst-driven to software-driven, with the analyst still in the driver's seat.

Timestamps: 

00:00:00 When hard becomes impossible 
00:01:37 The biggest change in SOC history 
00:05:16 What attackers can now do with AI 
00:08:13 Why patching can't be your core defense 
00:11:58 The analyst becomes the quality gate 
00:13:11 Preemptive cybersecurity, explained 
00:24:33 Advice for SOC managers