Episodes

  • Seashell Blizzard Ramping Up Operations and OSINT Trends of DPRK Threat Actors

    Seashell Blizzard Ramping Up Operations and OSINT Trends of DPRK Threat Actors
    Jan 22 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Elise Eldridge and Anna Seitz to discuss the most recent notable developments across the threat landscape. The threat actor, also known as Sandworm or APT44, has also been observed resuming the use of the wrappers WalnutWipe and SharpWipe, and expanded the use of the Prickly Pear malware downloader. The team highlights the geopolitical implications of these attacks, particularly in the context of Russia's influence on energy and global events. Sherrod also touches on the history of wipers in cyber operations and transitions to a discussion with Elise about trends in North Korean cyber activity, emphasizing Microsoft's ongoing efforts to analyze and mitigate these threats. In this episode you’ll learn: Why recent attacks have targeted the European energy sector How Seashell Blizzard’s attacks in 2024 involved spear-phishing campaigns Why North Korean hackers infiltrate companies through remote IT job programs Some questions we ask: How has Seashell Blizzard returned to using wipers, and what might explain this shift? After sending out crafted spear-phishing emails, what happens next in the attack chain? How might global geopolitics impact Seashell Blizzard's campaigns? Resources: View Elise Eldridge LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    26 mins
  • Threat Landscape Update: North Korean IT Workers, OSINT, and Remote Monitoring and Management Abuse

    Threat Landscape Update: North Korean IT Workers, OSINT, and Remote Monitoring and Management Abuse
    Jan 8 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Caitlin Hopkins, Diana Duvieilh, and Anna Seitz to discuss the latest trends in cybersecurity threats. The team explores OSINT observations around Remote Monitoring and Management (RMM) tools like Screen Connect by nation-state actors and reveals how they are used to deploy malware like AsyncRAT, ransomware, and execute phishing scams. They also uncover alarming tactics, such as North Korean IT workers posing as legitimate coders to infiltrate organizations, who steal cryptocurrency and use it to fund their regime. Since 2017 they have contributed to the theft of more than $3 billion. In this episode you’ll learn: The role of tech support scam websites in tricking victims into allowing remote access How cybercriminal and nation-state actors are increasingly exploiting remote monitoring Why the financial services sector is a major target for cyberattacks Some questions we ask: What is Screen Connect, and why is it attractive to threat actors? How long have RMM tools been used in C2 frameworks? Why are remote management tools being used in command-and-control systems? Resources: View Caitlin Hopkins on LinkedIn View Diana Duvieilh on LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    28 mins
  • Doctors’ Perspective: The Rise of Healthcare Ransomware

    Doctors’ Perspective: The Rise of Healthcare Ransomware
    Dec 18 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Christian Dameff and Jeff Tully, co-directors from the UCSD Center for Healthcare Cybersecurity, and contributors to our recent Healthcare Ransomware report. They discuss their unique backgrounds as doctors and hackers, focusing on healthcare cybersecurity, and the growing risks of hospital ransomware attacks. Christian shares his journey from hacking as a teenager to combining his passion for medicine and cybersecurity, particularly the risks posed to patient safety by vulnerable medical devices. Jeff adds his perspective, highlighting the parallels between medicine and hacking, and their efforts at UCSD to bring evidence-based research to healthcare cybersecurity. The conversation explores the challenges and importance of protecting critical healthcare systems from cyber threats, aiming to improve patient safety and outcomes. In this episode you’ll learn: How medical device vulnerabilities reveal the impact of cybersecurity on patient care The lack of comprehensive data on healthcare ransomware attacks When ransomware-induced disruptions can delay life-saving procedures Some questions we ask: As healthcare providers, what stands out to you about ransomware in healthcare? What does the UCSD Center for Healthcare Cybersecurity do? What ransomware attacks are common in healthcare, and how do they differ from other industries? Resources: View Jeff Tully on LinkedIn View Christian Dameff on LinkedIn View Sherrod DeGrippo on LinkedIn Healthcare Ransomware Report Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    43 mins
  • A Couple of Rats Pick Up New Tricks, Un Proposes Cybercrime Treaty

    A Couple of Rats Pick Up New Tricks, Un Proposes Cybercrime Treaty
    Dec 4 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Microsoft’s Dinesh Natarajan, Senior Threat Hunter, and Thomas Ball, Senior Security Researcher. They unpack recent findings around AsyncRAT, a remote access Trojan (RAT) used for keylogging, data exfiltration, and deploying further malware. Dinesh explains how attackers are now using screen-sharing tools, like Screen Connect, as part of a new infection chain that makes the malware delivery process more deceptive. Thomas then shares insights on SectopRAT, another threat targeting browser data and crypto wallets. Uniquely, this RAT creates a second desktop, allowing attackers to operate undetected. Next, Sherrod talks with Microsoft’s Senior Director of Diplomacy, Kaja Ciglic, about the UN’s proposed cybercrime treaty. Originally spearheaded by Russia, the treaty aims to create a global framework for prosecuting cybercrime, but critics worry about its potential impact on freedom of expression and human rights. In this episode you’ll learn: How tech support scam emails lead to AsyncRAT installations on different devices The importance of leveraging tools like Microsoft Defender's SmartScreen for protection The treaty encourages cooperation but may let governments exploit unclear cybercrime definitions Some questions we ask: How does social engineering through email play a role in these attacks? What capabilities does AsyncRat have, and why is it so concerning? How do we ensure the treaty doesn't impact freedom of expression or human rights? Resources: View Dinesh Natarajan on LinkedIn View Thomas Ball on LinkedIn View Kaja Ciglic on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    44 mins
  • Between Two Gregs: An Update on the North Korean Threat Landscape

    Between Two Gregs: An Update on the North Korean Threat Landscape
    Nov 20 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Proofpoint’s Greg Lesnewich and Microsoft’s Greg Schloemer to share the unique threat posed by North Korea’s (DPRK) state-sponsored cyber activities. The Gregs discuss their years of experience tracking North Korean cyber actors and the distinct tactics that set DPRK apart from other nation-sponsored threats. The conversation also explores North Korea’s high stakes, as DPRK threat actors operate under intense pressure from government handlers, adding a layer of urgency and fear to their operations. They share insights into North Korea’s aggressive use of stolen cryptocurrency to fund the regime’s initiatives, like ballistic missile tests, and discuss the broader geopolitical impact. In this episode you’ll learn: The technical sophistication and the relentlessness of DPRK cyber tactics Complex motives behind funding and sustaining the North Korean government The training and skills development of North Korean cyber operators Some questions we ask: How do North Korean threat actors set up their relay networks differently? What sets North Korea apart from other nation-sponsored threat actors? How do North Korean cyber actors differ from traditional e-crime actors? Resources: View Greg Schloemer on LinkedIn View Greg Lesnewich on LinkedIn View Sherrod DeGrippo on LinkedIn Blog links: Citrine Sleet Observed Exploiting Zero Day New North Korean Threat Actor Identified as Moonstone Sleet East Asia Threat Actor Technique Report Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    45 mins
  • Microsoft’s Yonatan Zunger on Red Teaming Generative AI

    Microsoft’s Yonatan Zunger on Red Teaming Generative AI
    Nov 6 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Yonatan Zunger, CVP of AI Safety and Security at Microsoft. The conversation delves into the critical role of the AI Red Team, which focuses on identifying vulnerabilities in AI systems. Yonatan emphasizes the importance of ensuring the safety of Microsoft’s AI products and the innovative methods the team employs to simulate potential threats, including how they assess risk and develop effective responses. This engaging dialogue offers insights into the intersection of technology, security, and human behavior in the evolving landscape of AI. In this episode you’ll learn: Why securing AI systems requires understanding their unique psychology The importance of training and technical mitigations to enhance AI safety How financial incentives drive performance improvements in AI systems Some questions we ask: How does Retrieval Augmented Generation (RAG) work? What are the potential risks with data access and permissions in AI systems? Should users tell language models that accuracy affects their rewards to improve responses? Resources: View Yonatan Zunger on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    39 mins
  • Vanilla Tempest: The Threat Actor Behind Recent Hospital Ransomware Attacks

    Vanilla Tempest: The Threat Actor Behind Recent Hospital Ransomware Attacks
    Oct 23 2024
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Anna and Keivan to discuss two prominent threat actors: Vanilla Tempest and Peach Sandstorm. Vanilla Tempest, a financially motivated cybercrime group, has been involved in recent ransomware attacks on U.S. hospitals, utilizing various ransomware payloads such as Ink. They are known for using tools like PowerShell scripts and Goot Loader to exfiltrate data and extort victims. Peach Sandstorm, an Iranian nation-state threat actor, focuses on cyber espionage and intelligence collection. They have targeted various sectors, including energy, defense, and critical infrastructure, and have shown increasing sophistication in their attacks. Later, Sherrod speaks with Colton Bremer, a senior security researcher at Microsoft, about his work on the Defender Experts (DEX) team. Colton explains the different tiers of DEX services, which focus on detecting and mitigating advanced threats that may bypass traditional security measures. In this episode you’ll learn: A backdoor called Tickler that uses Azure infrastructure for command and control The significance of these groups' tactics and maintaining ransomware resiliency The different tiers of DEX services detecting and mitigating advanced threats Some questions we ask: How does Vanilla Tempest typically execute their attacks? Has Peach Sandstorm evolved over time in their cyber espionage efforts? What can individuals or organizations do to mitigate cloud identity abuse? Resources: View Colton Bremer on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    33 mins
  • Gingham Typhoon’s Cyber Expansion Into the South Pacific

    Gingham Typhoon’s Cyber Expansion Into the South Pacific
    Oct 9 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Nick Monaco, Principal Threat Intelligence Analyst at Microsoft, delving into findings from Microsoft's April 2024 East Asia threat report. They discuss Gingham Typhoon's expanding cyber operations in the South Pacific, notably targeting strategic partners like Papua New Guinea despite their involvement in China's Belt and Road Initiative. The conversation shifts to Nylon Typhoon's global espionage efforts, including recent activities in South America and Europe. They also cover Volt Typhoon's sophisticated attacks on U.S. critical infrastructure and highlight Storm 1376's (now Tides of Flood) use of AI-generated news anchors for spreading misinformation. This episode emphasizes the evolving nature of cyber threats and influence operations, including the creative use of technology by adversaries to advance their agendas. * This episode is from April 2024 and is not new information. In this episode you’ll learn: How Nylon Typhoon targets geopolitical intelligence in South America and Europe The evolving landscape of influence operations and China's growing capabilities How disinformation campaigns have exploited real-world events Some questions we ask: How has generative AI changed influence operations and disinformation? What are the key trends in North Korean cyber operations with cryptocurrency and AI? Why are Chinese influence operations engaging with questions on social media?  Resources: View Nick Monaco on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    39 mins