Episodios

  • Inside THOR Collective, a Dispersed Team Delivering Open-Source Research

    Inside THOR Collective, a Dispersed Team Delivering Open-Source Research
    Apr 30 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Lauren Proehl, Sydney Marrone, and Jamie Williams to dig into the THOR Collective — a fresh, community-driven initiative bringing modern energy to threat intel. The group discusses the ongoing tension where developers focus on user-friendly design while security professionals aim to break things to prevent malicious use. They also dive into the THOR Collective, a community-driven initiative with open-source projects like Hearth and their twice-weekly Substack newsletter, Dispatch, which combines research, memes, and real-world lessons to uplift the InfoSec community. The conversation touches on the challenges of security, the disconnect between the public and understanding risks, and the need for more user-friendly, AI-driven security solutions that cater to various skill levels. In this episode you’ll learn: The value of consistently publishing high-quality content How the THOR Collective addresses this issue through innovative and digestible content The importance of making complex InfoSec topics approachable for different experience levels Some questions we ask: What’s going on with the rise in toll scam text messages? Why has social engineering remained such a successful tactic for threat actors? How does THOR Collective welcome new voices in InfoSec, and why is this crucial in today’s security landscape? Resources: View Lauren Proehl on LinkedIn View Sydney Marrone on LinkedIn View Jamie Williams on LinkedIn View Sherrod DeGrippo on LinkedIn THOR Collective Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    41 m
  • Star Blizzard Shifts Tactics to Spear-Phishing on Whatsapp

    Star Blizzard Shifts Tactics to Spear-Phishing on Whatsapp
    Apr 16 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Anna Seitz and Sarah Pfabe to dive into the activities of the Russian-aligned threat actor, Star Blizzard. Active since 2022, Star Blizzard recently shifted tactics by using WhatsApp for spear-phishing campaigns targeting government officials, NGOs, and academics. The team discusses how this change in approach may be a response to previous exposure of their tactics. They also explore the resilience of Star Blizzard, highlighting Microsoft's disruption of their operations, including the seizure of domains, and the ongoing threat posed by this actor despite legal actions. In this episode you’ll learn: Why threat actors like Star Blizzard are highly resilient and quickly adapting What steps users take to avoid falling victim to mobile malware Challenges of monitoring WhatsApp activity and why this platform has become a target Some questions we ask: What role do QR codes play in Star Blizzard’s phishing campaigns? Why do you think phishing continues to be the number one access vector? How resilient is Star Blizzard when facing disruptions like domain seizures or legal actions? Resources: View Sarah Pfabe on LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    39 m
  • Microsoft’s 50th Anniversary: Security Then and Now

    Microsoft’s 50th Anniversary: Security Then and Now
    Apr 2 2025
    In this special episode marking 50 years of Microsoft, host Sherrod DeGrippo is joined by Charlie Bell, Stephanie Calabrese, John Lambert, and Scott Woodgate to take a deeper look at Microsoft’s incredible journey in cybersecurity. They share their experiences and reflections on how the company has grown over the last five decades, from the early days of proprietary systems to the transformative rise of cloud computing and AI. As they celebrate this milestone, the conversation dives into the evolution of security practices, the development of key initiatives like the Microsoft Threat Intelligence Center and the Secure Future Initiative, and the culture of collaboration that has always been at the heart of Microsoft’s approach to tackling cybersecurity challenges. In this episode you’ll learn: How Microsoft evolved to lead the charge in cloud computing and AI Why Microsoft's security efforts have influenced the broader tech industry The evolution of Microsoft’s security, from XP Service Pack 2 to the Secure Future Initiative Some questions we ask: How did the company’s culture and products impact you early on? How have you seen Microsoft’s prioritization toward cybersecurity create change? Resources: View Charlie Bell on LinkedIn View Stephanie Calabrese on LinkedIn View John Lambert on LinkedIn View Scott Woodgate on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    55 m
  • The Professionalization of the Ransomware Criminal Ecosystem

    The Professionalization of the Ransomware Criminal Ecosystem
    Mar 19 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by ransomware experts Allan Liska from Recorded Future and Jonathan Braley, Director of Threat Intelligence for IT-ISAC, to get a pulse check on the current state of ransomware. They discuss how ransomware has shifted from simple attacks, like Locky, to more sophisticated, high-stakes campaigns targeting entire networks and demanding millions of dollars. Allan and Jonathan also highlight the rise of ransomware-as-a-service, the emergence of big game hunting attacks, and the increasingly professionalized criminal ecosystem surrounding ransomware. The conversation further explores the psychological aspects of cybercrime, focusing on the mindset of ransomware operators—particularly in Eastern Europe and Russia—where the line between crime and business can often be blurred. In this episode you’ll learn: Why attackers now target entire networks instead of just single machines How cybercriminal groups turned ransomware into a profitable business model The unique challenges healthcare employees face during ransomware attacks Findings from IT-ISAC's recent ransomware reports Some questions we ask: How did the Colonial Pipeline attack lead to real-world actions? Will paying the ransom restore the organization's data and operations? What are the differences between ransomware from 10-12 years ago and ransomware today? Resources: View Allan Liska on LinkedIn View Jonathan Braley on LinkedIn View Sherrod DeGrippo on LinkedIn IT-ISAC Ransomware report Food and AG-ISAC Ransomware report Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    41 m
  • Malvertising Campaign Leads to Info Stealers Hosted on Github

    Malvertising Campaign Leads to Info Stealers Hosted on Github
    Mar 6 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Senior Microsoft Security Researcher Kajhon Soyini to explore the Luma Stealer cryptocurrency mining campaign targeting individual computers as part of a large-scale malvertising campaign. They discuss the sophisticated attack chain, which includes DLLs, clipboard malware, process injection via Explorer.exe, and how this impacted nearly one million devices around the globe. Kajhon explains how attackers use registry modifications, WMI event consumers, and obfuscation techniques like non-standard ports and reverse shells to maintain persistence and evade detection. The duo also covers Microsoft's defense efforts and the challenges of tracking down the origins of these attacks. In this episode you’ll learn: Why the attack chain incorporates legacy malware like NetSupport RAT The overlap between the Luma Stealer and Donarium malware families How Luma Stealer uses GitHub repositories and redirector networks to deliver malicious payloads Some questions we ask: Can you explain how the malware uses the “image file execution objects” registry path? What role does Netcat play in this campaign’s command and control? Why do people still mine cryptocurrency today, with all the complexities and attack methods? Resources: View Kajhon Soyini on LinkedIn View Sherrod DeGrippo on LinkedIn Connect with Sherrod and the team at RSAC Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    35 m
  • A Blizzard Is Impacting NATO and Ukraine – The Latest on Russian Cyber Threats

    A Blizzard Is Impacting NATO and Ukraine – The Latest on Russian Cyber Threats
    Feb 19 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by two Microsoft security researchers to analyze the latest Russian nation-sponsored cyber threat activity. They discuss how Russian threat actors—collectively referred to by Microsoft with the Blizzard suffix—are primarily targeting Ukraine and NATO member states, focusing on espionage, influence operations, and cyber disruption. The conversation covers Russia’s reliance on cybercrime infrastructure, the vulnerabilities of academic and IT supply chains, and the evolving tactics of groups like Secret Blizzard and Seashell Blizzard. In this episode you’ll learn: Why 90% of Russian cyber-attacks target Ukraine and NATO member states How Russian threat actors exploit academic identities to infiltrate government networks The role of cybercriminal marketplaces in supplying tools and access to nation-state actors Some questions we ask: How does Secret Blizzard leverage infrastructure from other threat groups? Is there evidence of collaboration between different Russian cyber groups? Why is identity security such a critical factor in cyber defense? Resources: Attending RSAC? Connect with Sherrod and Microsoft View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    23 m
  • Microsoft’s CVP of Fraud on Combating Ecosystem Abuse

    Microsoft’s CVP of Fraud on Combating Ecosystem Abuse
    Feb 5 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by two expert guests to explore critical challenges in today’s evolving threat landscape. First, Sherrod sits down with Kelly Bissell, CVP of Fraud at Microsoft, to discuss the complexities of combating fraud and product abuse. Kelly digs into the unique challenges Microsoft faces, highlighting prevalent schemes such as crypto mining, tech support scams, and the exploitation of deepfakes. Kelly also shares insights into Microsoft’s proactive approach, including recent Azure policy changes and efforts to detect and prevent fraud across its services, especially those attempting to use the compute power for crypto mining. Later, Sherrod is joined by Priyanka Ramesha, Senior Threat Researcher on the Defender Experts team, to examine the rising risks of cloud-native attacks. They unpack why threat actors are increasingly targeting the cloud, exploiting its complexity, scalability, and common misconfigurations. Priyanka explains how attackers gain initial access through tactics like phishing, API exploitation, and OAuth abuse, and outlines their methods for credential theft, lateral movement, and data exfiltration. In this episode you’ll learn: What crypto mining looks like in Azure and how Microsoft detects and prevents it The five main areas of fraud and product abuse that Microsoft focuses on How attackers exploit the complexity and misconfigurations in cloud infrastructures Some questions we ask: How long do crypto mining operations run unnoticed in a customer's environment? What changes did Microsoft make to its policy regarding crypto mining? Why are legitimate apps sometimes compromised and used in attacks? Resources: View Kelly Bissell on LinkedIn View Priyanka Ramesha on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    51 m
  • Seashell Blizzard Ramping Up Operations and OSINT Trends of DPRK Threat Actors

    Seashell Blizzard Ramping Up Operations and OSINT Trends of DPRK Threat Actors
    Jan 22 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Elise Eldridge and Anna Seitz to discuss the most recent notable developments across the threat landscape. The threat actor, also known as Sandworm or APT44, has also been observed resuming the use of the wrappers WalnutWipe and SharpWipe, and expanded the use of the Prickly Pear malware downloader. The team highlights the geopolitical implications of these attacks, particularly in the context of Russia's influence on energy and global events. Sherrod also touches on the history of wipers in cyber operations and transitions to a discussion with Elise about trends in North Korean cyber activity, emphasizing Microsoft's ongoing efforts to analyze and mitigate these threats. In this episode you’ll learn: Why recent attacks have targeted the European energy sector How Seashell Blizzard’s attacks in 2024 involved spear-phishing campaigns Why North Korean hackers infiltrate companies through remote IT job programs Some questions we ask: How has Seashell Blizzard returned to using wipers, and what might explain this shift? After sending out crafted spear-phishing emails, what happens next in the attack chain? How might global geopolitics impact Seashell Blizzard's campaigns? Resources: View Elise Eldridge LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Más Menos
    26 m
adbl_web_global_use_to_activate_webcro805_stickypopup