Player FM - Internet Radio Done Right
0-10 subscribers
Checked 3d ago
Lagt til two år siden
Innhold levert av CrowdStrike. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av CrowdStrike eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.
Player FM - Podcast-app
Gå frakoblet med Player FM -appen!
Gå frakoblet med Player FM -appen!
Adversary Universe Podcast
Merk alt (u)spilt...
Manage series 3490818
Innhold levert av CrowdStrike. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av CrowdStrike eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.
Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you defend against them? Welcome to the Adversary Universe podcast, where CrowdStrike answers all of these questions — and more. Join our hosts, a pioneer in adversary intelligence and a specialist in cybersecurity technology, as they unmask the threat actors targeting your organization.
…
continue reading
45 episoder
Merk alt (u)spilt...
Manage series 3490818
Innhold levert av CrowdStrike. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av CrowdStrike eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.
Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you defend against them? Welcome to the Adversary Universe podcast, where CrowdStrike answers all of these questions — and more. Join our hosts, a pioneer in adversary intelligence and a specialist in cybersecurity technology, as they unmask the threat actors targeting your organization.
…
continue reading
45 episoder
Alle episoder
×
1 A Deep Dive into DeepSeek and the Risks of Foreign LLMs 27:26
27:26
Spill senere
Spill senere
Lister
Lik
Likt27:26
DeepSeek took the internet by storm earlier this year, making headlines and sparking conversations about its development, use, and associated risks. Today, Adam and Cristian take a deep dive into the new AI model. At a time when new AI models are constantly emerging, the launch of DeepSeek has led to questions and concerns around AI model security, data security, and national security. What is DeepSeek, and how was it trained? What are the risk implications of using it? Are there safe ways to explore new AI models, or should they be avoided entirely? And how worried do we need to be about data poisoning? Tune in for the answers to these questions and more in this episode of the Adversary Universe podcast.…

1 Putting a Spotlight on Energy Sector Threats with Corelight's Greg Bell 34:26
34:26
Spill senere
Spill senere
Lister
Lik
Likt34:26
Cyberattacks targeting critical infrastructure have made more headlines in recent years, sparking concern about how these systems are protected. Adversaries are taking aim at older technologies that are both essential to everyday life and difficult to secure. Our guest for this episode is Greg Bell, chief strategy officer at Corelight. Before he co-founded the network security firm, Greg spent most of his career working in the National Laboratory system, part of the U.S. Department of Energy. He brings his perspective and expertise to this conversation about energy sector threats, the adversaries behind them, and the unique challenges that utility organizations face in detecting and defending against cyberattacks. There is a scary side to energy sector threats — but there is also an optimistic side. Adam, Cristian, and Greg discuss everything from the history of critical infrastructure threats to the attacks they’re seeing today, the complications of securing energy systems, and collaborative efforts to improve defense. Key to these efforts are partnerships like the one between CrowdStrike and Corelight, which work together to improve network threat detection and response. Come for the comprehensive look at energy sector threats and stay for Cristian’s energy sector puns in this episode of the Adversary Universe podcast.…

1 See You I-Soon: A Peek at China’s Offensive Cyber Operations 36:13
36:13
Spill senere
Spill senere
Lister
Lik
Likt36:13
“It would not be an understatement to say that China is the number one national security concern that I think we have here in the West.” China’s offensive cyber activity has undergone a massive shift: What used to be simple smash-and-grab operations in the mid-2000s have evolved into sophisticated business models. We got a lens into this environment through a leak stemming from Chinese company I-Soon, whose data provided a narrow but revealing glimpse into the Chinese cyber contractor marketplace. I-Soon is a mid-sized contractor that has been operating since 2010. It provides state-sponsored advanced persistent threat (APT) cyber operations and tools, surveillance products and training for public security agencies, intelligence services and the military. The leak, which came from an anonymous GitHub user, included its internal documents and employee chat logs. These shed light on its products, services and customers as well as how some China-nexus adversaries are connected and sharing tools and capabilities. Adam and Cristian take a deep dive into these findings and how Chinese offensive cyber operations reached this point. They also dig into which PANDA adversaries are connected to I-Soon, how the cyber contractor recruits talent and what we learned about its disgruntled staff. The key takeaway? Leaks like this won’t stop adversaries — and China’s cyber operations aren’t slowing down.…

1 The Most Prolific Adversaries and Threats of 2024 33:01
33:01
Spill senere
Spill senere
Lister
Lik
Likt33:01
It has been another busy year for defenders and adversaries alike. As we wrap up 2024, Adam and Cristian reflect on the nation-state and eCrime threat activity that defined this year and what they expect as we head into 2025. Tune in to hear their observations on changing eCrime activity in Latin America, Chinese adversaries evolving their tactics and targeting telecommunications entities, the disruption of eCrime operations in the United States and more. And of course, you’ll hear the stories and context behind how these events unfolded and how we got to where we are today. Thank you to our listeners for all your support this year. We appreciate you sharing feedback and topics you’d like to hear on the show. As we plan for 2025, we anticipate another year of in-depth conversations, adversary insight and guest perspectives on the Adversary Universe podcast. Happy holidays!…

1 Cross-Domain Attacks: Know Them, Find Them, Stop Them 40:00
40:00
Spill senere
Spill senere
Lister
Lik
Likt40:00
Adversaries have realized their time-honored attack methods involving clunky malware and malicious attachments are no longer working, largely due to endpoint detection and response tools alerting security teams to their activity. To improve their success rate, many are turning to cross-domain attacks. Cross-domain attacks span multiple domains within an organization’s environment; namely, identity, endpoint and cloud. An adversary most often starts with a set of stolen credentials, which allows them to log in and operate under the guise of a legitimate employee. From there, they might target the cloud control plane to access more accounts or pivot to unmanaged devices. All the while, they move silently, achieving their goals without triggering alarms. “The adversaries have really figured out how to operate from the shadows more effectively,” Adam says. In this episode, he and Cristian discuss how cross-domain attacks unfold in a target environment; which adversaries are adopting this tradecraft; and how organizations can better detect, identify and mitigate these threats before it’s too late. Watch our Cyber Threat Summit (focused on the rise of cross-domain attacks) on-demand: https://www.crowdstrike.com/resources/crowdcasts/cyber-threat-summit/…

1 LIMINAL PANDA and the Implications of Global Telco Targeting 39:59
39:59
Spill senere
Spill senere
Lister
Lik
Likt39:59
On Nov. 19, 2024, Adam testified in front of the U.S. Senate Judiciary Subcommittee on Privacy, Technology, and the Law on Chinese cyber threats to critical infrastructure. This was the first time he publicly spoke about LIMINAL PANDA, a China-nexus state-sponsored threat actor that has been targeting telecommunications organizations since at least 2020. LIMINAL PANDA is a newly named adversary, but CrowdStrike has been tracking its activity for over three years. It uses custom tools and demonstrates extensive knowledge of telco networks, including the connections between providers. And it's not alone: There are multiple adversaries targeting telcos, with good reason — the access they grant, and the data they possess, is a gold mine for threat actors. But LIMINAL PANDA’s activity does more than showcase why critical infrastructure is a valuable target. It also represents how Chinese cyber activity has evolved since the mid-2000s, when it mostly involved “smash and grab” operations. Now, China has refined its espionage operations to conduct subtle and advanced attacks targeting critical infrastructure entities around the world. In this episode, Adam and Cristian dig deep into the discovery of LIMINAL PANDA, the maturation of Chinese cyber operations and the scary consequences of telco-focused cyberattacks. Adam shares more about his congressional testimony and the value of keeping government officials informed on adversary activity. Come for Adam and Cristian’s Thanksgiving recipes, and stay for a deep-dive on this evolving nation-state threat, in this episode of the Adversary Universe podcast. Read Adam's testimony here: https://www.judiciary.senate.gov/committee-activity/hearings/big-hacks-and-big-tech-chinas-cybersecurity-threat…

1 Exploring Offensive Security with CrowdStrike Red Teamers 47:39
47:39
Spill senere
Spill senere
Lister
Lik
Likt47:39
If a business wants to know what an adversary might be capable of, they can seek the help of a red team. These cybersecurity professionals are tasked with emulating adversary activity to achieve specific objectives in their clients’ environments. Their goal is to find an organization’s weaknesses — before a real adversary does — so it can strengthen its security posture. But what does a red team actually do, and who are the people on these teams? In this episode, Cristian is joined by CrowdStrike Director of Professional Services Vincent Uguccioni and Professional Services Principal Consultant Brent Harrell to dive into all things red teaming. Both seasoned experts with fascinating backgrounds, Vincent and Brent define what red teaming is (and what it isn’t), explain how it has evolved, debunk common misconceptions about what red teamers do and explain the value of the many different skills the members of a red team have. The goal of the red team is to help, not hurt. Red teamers may need to think like an adversary when they’re navigating a client environment, but their broader strategy involves collaborating with the client and blue team to guide remediation and improve the client's security. Vincent and Brent also walk us through the process of a red team engagement, from initial client discussions to final reporting, and share how they adjust their approaches as adversary techniques evolve. And if you’re interested in becoming a red teamer, they share some guidance for that as well. On a related note, we recently introduced CrowdStrike AI Red Team Services. Read our blog for more details: https://www.crowdstrike.com/en-us/blog/crowdstrike-launches-ai-red-team-services/…

1 The Latest in China-Taiwan Cyber Tensions 33:30
33:30
Spill senere
Spill senere
Lister
Lik
Likt33:30
China and Taiwan have a long history of geopolitical tension that has evolved from land and sea to cyberspace. Relations between the two recently took an interesting turn when the Chinese Ministry of State Security (MSS) claimed hacktivist entity Anonymous 64 targeted China and its territories with attempted disinformation and public communication disruption. The Chinese government further alleged the activity was directed by the Taiwanese government, whose officials are investigating the activity and expressed the claims are false. These allegations mark an interesting shift in the relations between China and Taiwan. In this episode, Adam and Cristian start with a 50,000-foot view of their nuanced, tense history. They define and discuss the organizations involved in these events and the details of their claims, and they share what we know about Anonymous 64. Why is this news significant? What are the geopolitical implications? And where have we seen similar activity in other regions? It is important to note that CrowdStrike has not independently verified the Chinese government’s accusations. Tune in to hear more about a story that blends politics, military strategy and digital warfare.…

1 How CrowdStrike Tracked INDRIK SPIDER from Origin to Takedown 53:35
53:35
Spill senere
Spill senere
Lister
Lik
Likt53:35
On Oct. 1, 2024, an international law enforcement coalition announced the disruption of a senior member of INDRIK SPIDER, who was also an affiliate of the BITWISE SPIDER ransomware as a service operation. CrowdStrike often works with law enforcement to identify, track and stop cyber threats, and we played a key role in this operation. In this episode, Adam and Cristian are joined by a member of CrowdStrike’s intelligence collection team to dive into the takedown, the years of cybercrime evolution that led to it and how CrowdStrike collects the intel that informs organizations and aids law enforcement activity. Their conversation takes us back to the early days of INDRIK SPIDER and traces the emergence and transformation of enterprise malware as it relates to this prolific threat actor. The story underscores how adversaries operate like businesses — and why they’re so hard to bring down. Tune in to learn the background and significance of INDRIK SPIDER and its takedown, its connections to Russian intelligence, the techniques used to investigate and attribute adversaries, what this means for the future of law enforcement against cybercrime and where cheese-covered sushi fits into the picture.…

1 Small But Mighty: The Kernel’s Essential Role in Cybersecurity Defense 35:24
35:24
Spill senere
Spill senere
Lister
Lik
Likt35:24
The kernel is the brain of the operating system. It controls everything that happens on a computer and has full access to the hardware and all system resources. Though it has a small code base, the kernel plays a critical role in how systems and applications operate, interact and stay secure. Due to the current architecture and design of Windows systems, cybersecurity products running in the platform — particularly those involved in endpoint protection — require kernel access to provide the highest levels of visibility, enforcement and tamper-resistance while meeting the strict performance requirements that large enterprise clients demand. Kernel access translates to stronger protection, better performance and adaptability to emerging threats. In this episode, Adam and Cristian are joined by cybersecurity expert Alex Ionescu to unpack what the kernel is and its critical role in cybersecurity defense. They explain threats to kernel security, why kernel access is critical for cybersecurity products and the testing that security products must undergo to gain kernel access. Looking ahead, they also discuss what we can expect for the future of collaboration among Microsoft, security researchers and larger security organizations.…

1 Coming Soon to Las Vegas: Adversary Universe Previews #FalCon2024 14:12
14:12
Spill senere
Spill senere
Lister
Lik
Likt14:12
Next week marks the start of Fal.Con 2024. CrowdStrike’s annual conference brings together cybersecurity leaders and practitioners, as well as our customers and partners, in Las Vegas for four days of keynotes, breakout sessions, workshops and demos. Adam and Cristian will both be speaking at this year’s show. In this episode, they share the talks they’re most excited about and how they tie into the broader threat landscape. Some sessions will dive into insights from the CrowdStrike Counter Adversary Operations team; some will explore how adversaries are using large language models (LLMs) and how to defend against adversarial use of AI technology. One will discuss generative AI and data security, in particular how genAI raises concerns around privacy, data fencing, and IP, as well as how data can be misused when training new AI models. A key highlight of Fal.Con is the Adversary Underground, during which Adam and Cristian will bring guests onstage to showcase a machine learning-based research project they’ve been working on. Register for the Fal.Con Digital Experience to stream the keynotes live during the show and view select sessions on-demand after the event.…

1 Intern Spotlight: Starting A Cyber Career with CrowdStrike 36:57
36:57
Spill senere
Spill senere
Lister
Lik
Likt36:57
For students aspiring to work in cybersecurity, sitting in a classroom isn’t enough to gain the skills and experience they need to succeed. Industry internships are invaluable opportunities to learn how security pros operate in the real world and understand the responsibilities each role requires. CrowdStrike’s University Program welcomes interns across virtually every field to gain this real-world experience. This summer, David Feldman and Chandler McClellan interned for the CrowdStrike threat intelligence and Falcon Adversary OverWatch teams, respectively. Like many cybersecurity pros, both David and Chandler found their way into the industry after first exploring different fields. In this episode, they join Adam to share the details of how they got into cybersecurity, how they discovered CrowdStrike’s internship program and the projects they’ve been tackling as part of the CrowdStrike team. “You just get to dive in,” says Chandler in this episode. “You feel like you’re doing meaningful work, and you are ... What we’re doing here matters.” Tune in to learn how CrowdStrike’s interns are aiding in the fight against adversaries, what they consider the coolest parts of their summer roles and more in this episode of the Adversary Universe podcast.…

1 Hunting the Rogue Insiders Operating for FAMOUS CHOLLIMA 31:17
31:17
Spill senere
Spill senere
Lister
Lik
Likt31:17
FAMOUS CHOLLIMA, a new adversary CrowdStrike is tracking, has recently made headlines for its insider threat activity. In April 2024, CrowdStrike Services responded to the first of several incidents in which FAMOUS CHOLLIMA threat actors targeted 30+ US-based companies. The insiders claimed to be US residents and were hired for remote IT positions, which granted them access they exploited to attempt data exfiltration, install malware and conduct other malicious activity. CrowdStrike has now informed more than 100 companies they have hired these threat actors as employees. In this episode, Adam and Cristian dig into the details of who FAMOUS CHOLLIMA is, how this attack was uncovered and why malicious insider threats are on the rise. They also examine the key findings of the CrowdStrike 2024 Threat Hunting Report, including the growth of cross-domain activity, adversary adoption of remote monitoring and management tools, and the concerning pattern of identity-focused attacks. Download the CrowdStrike 2024 Threat Hunting Report today: https://www.crowdstrike.com/resources/reports/threat-hunting-report/…

1 Talking OT Security with Fernando Madureira, Global CISO of Cosan 20:54
20:54
Spill senere
Spill senere
Lister
Lik
Likt20:54
Where in the world are Adam and Cristian? In this episode, they’re coming to you live from São Paulo, Brazil, where they sat down with a special guest: Fernando Madureira. Fernando is the Global CISO of Cosan, a Brazilian conglomerate of several businesses spanning energy, transportation and logistics, and other sectors that operates around the world. Given Cosan’s size and the nature of its business, Fernando has a broad range of threats at top of mind. Operational technology (OT) security is a key concern because adversaries seek access to OT devices and traffic, and it requires a different mindset and technology than a modern IT environment. Social engineering is another, as adversaries attempt to disguise themselves as employees to manipulate customers and partners. Tune in to hear a conversation that explores OT security, modern phishing scams and how the Global CISO of a major company is taking steps to protect it.…

1 How Adversaries Respond to Law Enforcement Takedowns 43:21
43:21
Spill senere
Spill senere
Lister
Lik
Likt43:21
What happens when there is a takedown of a major cybercriminal group or law enforcement activity has a major impact on its leadership? In this episode, Adam and Cristian unpack what happens in the aftermath of a takedown, including how some groups splinter, reemerge and even rebrand.
Velkommen til Player FM!
Player FM scanner netter for høykvalitets podcaster som du kan nyte nå. Det er den beste podcastappen og fungerer på Android, iPhone og internett. Registrer deg for å synkronisere abonnement på flere enheter.