Microsoft Threat Intelligence Podcast

In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Elise Eldridge and Anna Seitz to discuss the most recent notable developments across the threat landscape.  

The threat actor, also known as Sandworm or APT44, has also been observed resuming the use of the wrappers WalnutWipe and SharpWipe, and expanded the use of the Prickly Pear malware downloader.

The team highlights the geopolitical implications of these attacks, particularly in the context of Russia's influence on energy and global events. Sherrod also touches on the history of wipers in cyber operations and transitions to a discussion with Elise about trends in North Korean cyber activity, emphasizing Microsoft's ongoing efforts to analyze and mitigate these threats. 

In this episode you’ll learn:      

• Why recent attacks have targeted the European energy sector 
• How Seashell Blizzard’s attacks in 2024 involved spear-phishing campaigns 
• Why North Korean hackers infiltrate companies through remote IT job programs 

Some questions we ask:       

• How has Seashell Blizzard returned to using wipers, and what might explain this shift? 
• After sending out crafted spear-phishing emails, what happens next in the attack chain? 
• How might global geopolitics impact Seashell Blizzard's campaigns? 

Resources:  

View Elise Eldridge LinkedIn  

View Anna Seitz on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Caitlin Hopkins, Diana Duvieilh, and Anna Seitz to discuss the latest trends in cybersecurity threats.  

The team explores OSINT observations around Remote Monitoring and Management (RMM) tools like Screen Connect by nation-state actors and reveals how they are used to deploy malware like AsyncRAT, ransomware, and execute phishing scams. They also uncover alarming tactics, such as North Korean IT workers posing as legitimate coders to infiltrate organizations, who steal cryptocurrency and use it to fund their regime. Since 2017 they have contributed to the theft of more than $3 billion. 

In this episode you’ll learn:      

• The role of tech support scam websites in tricking victims into allowing remote access 
• How cybercriminal and nation-state actors are increasingly exploiting remote monitoring 
• Why the financial services sector is a major target for cyberattacks 

Some questions we ask:     

• What is Screen Connect, and why is it attractive to threat actors? 
• How long have RMM tools been used in C2 frameworks? 
• Why are remote management tools being used in command-and-control systems? 

Resources:  

View Caitlin Hopkins on LinkedIn  

View Diana Duvieilh on LinkedIn  

View Anna Seitz on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Christian Dameff and Jeff Tully, co-directors from the UCSD Center for Healthcare Cybersecurity, and contributors to our recent Healthcare Ransomware report.  

They discuss their unique backgrounds as doctors and hackers, focusing on healthcare cybersecurity, and the growing risks of hospital ransomware attacks. Christian shares his journey from hacking as a teenager to combining his passion for medicine and cybersecurity, particularly the risks posed to patient safety by vulnerable medical devices. Jeff adds his perspective, highlighting the parallels between medicine and hacking, and their efforts at UCSD to bring evidence-based research to healthcare cybersecurity. The conversation explores the challenges and importance of protecting critical healthcare systems from cyber threats, aiming to improve patient safety and outcomes. 

In this episode you’ll learn:      

• How medical device vulnerabilities reveal the impact of cybersecurity on patient care 
• The lack of comprehensive data on healthcare ransomware attacks 
• When ransomware-induced disruptions can delay life-saving procedures 

Some questions we ask:     

• As healthcare providers, what stands out to you about ransomware in healthcare? 
• What does the UCSD Center for Healthcare Cybersecurity do? 
• What ransomware attacks are common in healthcare, and how do they differ from other industries? 

Resources:  

View Jeff Tully on LinkedIn  

View Christian Dameff on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Healthcare Ransomware Report 

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Microsoft’s Dinesh Natarajan, Senior Threat Hunter, and Thomas Ball, Senior Security Researcher. They unpack recent findings around AsyncRAT, a remote access Trojan (RAT) used for keylogging, data exfiltration, and deploying further malware.  

Dinesh explains how attackers are now using screen-sharing tools, like Screen Connect, as part of a new infection chain that makes the malware delivery process more deceptive. Thomas then shares insights on SectopRAT, another threat targeting browser data and crypto wallets. Uniquely, this RAT creates a second desktop, allowing attackers to operate undetected.  

Next, Sherrod talks with Microsoft’s Senior Director of Diplomacy, Kaja Ciglic, about the UN’s proposed cybercrime treaty. Originally spearheaded by Russia, the treaty aims to create a global framework for prosecuting cybercrime, but critics worry about its potential impact on freedom of expression and human rights. 

In this episode you’ll learn:      

• How tech support scam emails lead to AsyncRAT installations on different devices 
• The importance of leveraging tools like Microsoft Defender's SmartScreen for protection 
• The treaty encourages cooperation but may let governments exploit unclear cybercrime definitions 

Some questions we ask:    

• How does social engineering through email play a role in these attacks? 
• What capabilities does AsyncRat have, and why is it so concerning? 
• How do we ensure the treaty doesn't impact freedom of expression or human rights? 

Resources:  

View Dinesh Natarajan on LinkedIn 

View Thomas Ball on LinkedIn 

View Kaja Ciglic on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Proofpoint’s Greg Lesnewich and Microsoft’s Greg Schloemer to share the unique threat posed by North Korea’s (DPRK) state-sponsored cyber activities. The Gregs discuss their years of experience tracking North Korean cyber actors and the distinct tactics that set DPRK apart from other nation-sponsored threats. The conversation also explores North Korea’s high stakes, as DPRK threat actors operate under intense pressure from government handlers, adding a layer of urgency and fear to their operations. They share insights into North Korea’s aggressive use of stolen cryptocurrency to fund the regime’s initiatives, like ballistic missile tests, and discuss the broader geopolitical impact.  

In this episode you’ll learn:      

• The technical sophistication and the relentlessness of DPRK cyber tactics 
• Complex motives behind funding and sustaining the North Korean government 
• The training and skills development of North Korean cyber operators 

Some questions we ask:     

• How do North Korean threat actors set up their relay networks differently? 
• What sets North Korea apart from other nation-sponsored threat actors? 
• How do North Korean cyber actors differ from traditional e-crime actors? 

Resources:  

View Greg Schloemer on LinkedIn  

View Greg Lesnewich on LinkedIn 

View Sherrod DeGrippo on LinkedIn  

Blog links: 

Citrine Sleet Observed Exploiting Zero Day 

New North Korean Threat Actor Identified as Moonstone Sleet 

East Asia Threat Actor Technique Report 

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Yonatan Zunger, CVP of AI Safety and Security at Microsoft. The conversation delves into the critical role of the AI Red Team, which focuses on identifying vulnerabilities in AI systems. Yonatan emphasizes the importance of ensuring the safety of Microsoft’s AI products and the innovative methods the team employs to simulate potential threats, including how they assess risk and develop effective responses. This engaging dialogue offers insights into the intersection of technology, security, and human behavior in the evolving landscape of AI.  

In this episode you’ll learn:      

• Why securing AI systems requires understanding their unique psychology 
• The importance of training and technical mitigations to enhance AI safety 
• How financial incentives drive performance improvements in AI systems 

Some questions we ask:     

• How does Retrieval Augmented Generation (RAG) work? 
• What are the potential risks with data access and permissions in AI systems? 
• Should users tell language models that accuracy affects their rewards to improve responses? 

Resources:  

View Yonatan Zunger on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Anna and Keivan to discuss two prominent threat actors: Vanilla Tempest and Peach Sandstorm. 

Vanilla Tempest, a financially motivated cybercrime group, has been involved in recent ransomware attacks on U.S. hospitals, utilizing various ransomware payloads such as Ink. They are known for using tools like PowerShell scripts and Goot Loader to exfiltrate data and extort victims. Peach Sandstorm, an Iranian nation-state threat actor, focuses on cyber espionage and intelligence collection. They have targeted various sectors, including energy, defense, and critical infrastructure, and have shown increasing sophistication in their attacks. Later, Sherrod speaks with Colton Bremer, a senior security researcher at Microsoft, about his work on the Defender Experts (DEX) team. Colton explains the different tiers of DEX services, which focus on detecting and mitigating advanced threats that may bypass traditional security measures. 

In this episode you’ll learn:      

• A backdoor called Tickler that uses Azure infrastructure for command and control 
• The significance of these groups' tactics and maintaining ransomware resiliency 
• The different tiers of DEX services detecting and mitigating advanced threats 

Some questions we ask:    

• How does Vanilla Tempest typically execute their attacks? 
• Has Peach Sandstorm evolved over time in their cyber espionage efforts? 
• What can individuals or organizations do to mitigate cloud identity abuse? 

Resources:  

View Colton Bremer on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Nick Monaco, Principal Threat Intelligence Analyst at Microsoft, delving into findings from Microsoft's April 2024 East Asia threat report. They discuss Gingham Typhoon's expanding cyber operations in the South Pacific, notably targeting strategic partners like Papua New Guinea despite their involvement in China's Belt and Road Initiative. The conversation shifts to Nylon Typhoon's global espionage efforts, including recent activities in South America and Europe. They also cover Volt Typhoon's sophisticated attacks on U.S. critical infrastructure and highlight Storm 1376's (now Tides of Flood) use of AI-generated news anchors for spreading misinformation. This episode emphasizes the evolving nature of cyber threats and influence operations, including the creative use of technology by adversaries to advance their agendas. 

* This episode is from April 2024 and is not new information. 

In this episode you’ll learn:      

• How Nylon Typhoon targets geopolitical intelligence in South America and Europe 
• The evolving landscape of influence operations and China's growing capabilities 
• How disinformation campaigns have exploited real-world events 

Some questions we ask:     

• How has generative AI changed influence operations and disinformation? 
• What are the key trends in North Korean cyber operations with cryptocurrency and AI? 
• Why are Chinese influence operations engaging with questions on social media? 

Resources:  

View Nick Monaco on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by the authors of the new book The Definitive Guide to KQL: Using Kusto Query Language for Operations, Defending, and Threat Hunting. Guests Rod Trent, Matt Zorich, and Mark Morowczynski discuss the significance of KQL (Kusto Query Language) in cloud data security and how it enables efficient data querying for threat detection in Microsoft products like Sentinel and Defender. They share insights from their own experiences, highlight key features of the book, and explain how both beginners and experts can benefit from KQL. Later in the episode Sherrod speaks with Senior Threat Hunter Lekshmi Vijayan about the growing trend of cyberattacks using malicious PowerShell commands. Lekshmi explains how attackers trick users into copying and pasting harmful code, often through compromised websites or phishing emails. They discuss how these attacks aim to install remote access tools like NetSupport RAT or information stealers, targeting sensitive data like browser credentials and crypto keys. 

In this episode you’ll learn:      

• How KQL is applied in real-world security scenarios including incident response 
• Key features and benefits of KQL when it comes to security and cloud data 
• Distinguishing between legitimate and malicious uses of remote management tools  

Some questions we ask:       

• How does KQL tie into the Microsoft ecosystem, like Defender and Copilot? 
• What advice would you give to someone new to KQL who wants to start learning? 
• What is the technique we're seeing with copy-pasting malicious PowerShell?  

Resources:  

View Mark Morowczynski on LinkedIn 

View Matt Zorich on LinkedIn 

View Rod Trent on LinkedIn 

View Lekshmi Vijayan on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo discusses North Korean threat actors with one of our Microsoft Threat Intelligence researchers and Greg Schloemer focusing on two prominent groups: Onyx Sleet and Storm 0530. Onyx Sleet is a long-standing espionage group known for targeting defense and energy sectors, particularly in the U.S. and India. However, they’ve diversified into ransomware, using tactics like malware downloaders, zero-day vulnerabilities, and a remote access Trojan called D-Track. The conversation also touches on the use of fake certificates and the group's involvement in the software supply chain space. 

In this episode you’ll learn:      

• The relationship between Onyx Sleet and Storm 0530 
• North Korea's broader strategy of using cyber-attacks and moonlighting activities 
• Surprising nature of recent attack chains involving vulnerability in the Chromium engine 

Some questions we ask:     

• Does Onyx Sleet engage in cryptocurrency activities as well as traditional espionage? 
• How does the use of a fake Tableau software certificate fit into Onyx Sleet's attack chain? 
• Where does the name "Holy Ghost" come from, and why did they choose it? 

Resources:  

View Greg Schloemer on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network. 

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Microsoft security researchers Anna Seitz and Daria Pop to discuss the latest trends in ransomware and the evolving role of AI in cyber threats. Daria Pop provides insights into the shifting tactics of Black Basta ransomware, including their use of phishing, social engineering, and remote management tools. The discussion also covers the persistence of malvertising and its challenges for defenders. Anna Seitz explores how state-sponsored threat actors, including Forest Blizzard, Emerald Sleet, and Crimson Sandstorm, are leveraging large language models (LLMs) for various malicious activities.  

In this episode you’ll learn:       

• Why the takedown of Qakbot impacted Black Basta’s strategies 
• What malvertising is and why its persistence is due to the complex nature of ad traffic 
• How the MITRE Atlas framework assists defenders in identifying new threats 

Some questions we ask:       

• What role does social engineering play in the campaigns involving Quick Assist? 
• How are North Korean threat actors like Emerald Sleep using LLMs for their campaigns? 
• Can you explain the changes in Black Basta’s initial access methods over the years? 

Resources:  

View Anna Seitz on LinkedIn  

View Daria Pop on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

On this week's episode of The Microsoft Threat Intelligence Podcast, we discuss the collaborative effort between Microsoft and Fortra to combat the illegal use of cracked Cobalt Strike software, which is commonly employed in ransomware attacks.  To break down the situation, our host, Sherrod DeGrippo, is joined by Richard Boscovich, Assistant General Counsel at Microsoft, Jason Lyons, Principal Investigator with the DCU, and Bob Erdman, Associate VP Research and Development at Fortra. The discussion covers the creative use of DMCA notifications tailored by geographic region to combat cybercrime globally. The group express their optimism about applying these successful techniques to other areas, such as phishing kits, and highlight ongoing efforts to make Cobalt Strike harder to abuse.   

In this episode you’ll learn:      

• The impact on detection engineers due to the crackdown on cracked Cobalt Strike 
• Extensive automation used to detect and dismantle large-scale threats 
• How the team used the DMCA creatively to combat cybercrime 

Some questions we ask:     

•  Do you encounter any pushback when issuing DMCA notifications? 
•  How do you plan to proceed following the success of this operation? 
•  Can you explain the legal mechanisms behind this take-down? 

Resources:  

View Jason Lyons on LinkedIn 

View Bob Erdman on LinkedIn   

View Richard Boscovich on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is live from Blue Hat Israel in Tel Aviv. Igal Lytzki and Din Serussi discuss their presentation on advanced phishing and evasion techniques, highlighting the rise of QR phishing and custom-made captures, which involve interactive challenges to bypass security systems. Gal Niv and Jonathan Jacobi discuss their experience with the Web3 challenge they created, focusing on a smart contract vulnerability on the Ethereum blockchain. Ida Vass, the mastermind behind BlueHat IL, talks about the conference’s impact and her motivation, driven by the community's spirit and the desire to continually innovate and Wolf Goerlich the keynote speaker, discusses his approach to the keynote, focusing on positive advancements in cybersecurity rather than dwelling on the negative. 

In this episode you’ll learn:      

• Practical advice for organizations to bolster their email security defenses 
• The critical need to apply historical attack models to new technologies 
• Progress in hardening OS and network security and the shift in threat actor tactics 

Some questions we ask:     

• What emerging technologies or threats do you find most intriguing or concerning? 
• How does the production level of BlueHat compare to other conferences? 
• What do state-sponsored email threats look like right now? 



Resources:  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Technical Program Manager at Microsoft Lynn Miyashita and Principal Research Manager, Andrew Paverd. They discuss the evolution of bug bounty programs into the realm of artificial intelligence, specifically focusing on Microsoft's initiative launched in October 2023. Lynn explains that the AI Bug Bounty incentivizes external security researchers to discover and report vulnerabilities in Microsoft's AI systems, such as Copilot, across various platforms including web browsers and mobile applications. Andrew elaborates on the concept of a "bug bar," which sets the criteria for vulnerabilities eligible for the program. They emphasize the importance of identifying security issues that could arise uniquely from AI systems, such as prompt injection vulnerabilities. The discussion highlights Microsoft's structured approach to handling reported vulnerabilities through their Security Response Center, emphasizing quick mitigation and coordination with researchers to ensure timely fixes and public disclosure. 

In this episode you’ll learn:      

• How AI Bug Bounty programs are reshaping traditional security practices 
• Dangers of prompt injection attacks, and their capacity to exfiltrate sensitive data 
• Why you should engage in AI bug hunting and contribute to the evolving security landscape 

Some questions we ask:     

• Which products are currently included in the Bug Bounty program? 
• Should traditional bug bounty hunters start doing AI bug bounty hunting? 
• How can someone get started with AI bug hunting and submitting to your program? 

Resources:  

View Lynn Miyashita on LinkedIn  

View Andrew Paverd on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Microsoft AI Bug Bounty Program 

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

In this episode of the Microsoft Threat Intelligence Podcast recorded at the RSA Conference in San Francisco, host Sherrod DeGrippo engages with a diverse group of cybersecurity experts. David Weston, VP of Operating System Security at Microsoft, discusses the evolution of Windows security and the role of AI. Jamie Williams from MITRE shares insights on the importance of product functionality in cybersecurity. Emma Stewart, Chief Power Grid Scientist at Idaho National Lab, talks about securing the digital transition of the power grid. Joe Slowik from MITRE emphasizes the importance of threat intelligence and integrating cybercrime entities into their attack framework. Lindsey O'Donnell, executive editor of Decipher, highlights AI's crucial role in cybersecurity and finally, Todd Pauley, deputy CISO of the Texas Education Agency, discusses the challenges faced by small school districts in Texas.   

In this episode you’ll learn:      

• How Windows security has transitioned from user-controlled to Microsoft-managed 
• The importance of understanding product functionality to combat cyber threats 
• Securing the power grid's digital transition and cloud technologies for grid control 

Some questions we ask:     

• What challenges and opportunities arise in securing the power grid's digital transition? 
• How does AI enhance security in Windows operating systems? 
• What were some of the most memorable sessions you attended at RSA? 

Resources:  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Mark Russinovich.  Mark Russinovich, CTO and Technical Fellow of Microsoft Azure, joins the show to talk about his journey from developing on-prem tools like Sysinternals to working in the cloud with Azure. Sherrod and Mark discuss the evolution of cybersecurity, the role of AI in threat intelligence, and the challenge of jailbreaking AI models. Mark shares his experiences with testing AI models for vulnerabilities, including his discovery of the "Crescendo" and "Masterkey" methods to bypass safety protocols. They also touch on the issue of poisoned training data and its impact on AI reliability, while highlighting the importance of staying ahead in cybersecurity. 

In this episode you’ll learn:      

• The shift from desktop computing to cloud-based systems and its implications 
• Potential consequences of AI models having overridable safety instructions 
• How AI training data can manipulate the outcomes generated by AI models 

Some questions we ask:     

• Will AI owners be able to stop data poisoning, or will it become more common? 
• Can you share challenges and vulnerabilities in maintaining the security of AI systems? 
• What sparked your interest in AI jailbreaks, and what trends are you seeing? 

Resources:  

View Mark Russinovich on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

AI jailbreaks: What they are and how they can be mitigated?

https://www.microsoft.com/en-us/security/blog/2024/06/04/ai-jailbreaks-what-they-are-and-how-they-can-be-mitigated/ 

Inside AI Security with Mark Russinovich | BRK227 

https://www.youtube.com/watch?v=f0MDjS9-dNw 

How Microsoft discovers and mitigates evolving attacks against AI guardrails.

https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails/ 

Google AI said to put glue on pizza.

https://www.businessinsider.com/google-ai-glue-pizza-i-tried-it-2024-5 

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by two of MSTIC’s finest analysts. They discuss recent trends in financially motivated cyber threats observed by Microsoft, focusing particularly on two cases: the Grandoreiro banking Trojan and the Luna Tempest crimeware actor. The Grandoreiro Trojan, active since 2017, has expanded globally beyond its initial Latin American focus, now targeting countries like the U.S. and the UK. This Trojan typically starts with phishing emails to steal financial information. Despite efforts to disrupt this activity, new clusters have emerged. The discussion also covers Luna Tempest, a U.S.- and UK-based extortion group targeting startups and smaller companies, particularly in sectors like insurance, FinTech, and biotech, seeking high payouts by threatening to release sensitive data. 

In this episode you’ll learn:      

• The resilience and adaptability of threat actors in response to global disruption efforts 
• Why Luna Tempest focuses solely on extortion without deploying ransomware 
• How the Grandoreiro Banking Trojan has expanded globally  

Some questions we ask:     

• How do we distinguish between the various threat actor groups and their malware? 
• What can businesses do to protect themselves from identity-based attacks? 
• Have these cybercriminals perfected an extortion program? 

Resources:  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Andrew Morris, Founder & Chief Architect at GreyNoise and Lauren Proehl, Director of Global Cyber Defense at Marsh McLennan. Lauren Proehl is an experienced cybersecurity leader who has helped defend against threat actors in Fortune 500 networks and has managed multiple divisions focused in defensive security and specializes in innovative cyber defense. GreyNoise operates a huge sensor network across the internet that collects primary sourced data on which vulnerabilities attackers are exploiting, when they start, and from where. Sherrod, Lauren, and Andrew discuss the effectiveness of banning ransomware payments, the importance of focusing on backup and disaster recovery strategies, the necessity of investing in basic security measures like endpoint detection and response, multi-factor authentication, and log storage.  

In this episode you’ll learn:      

• The potential for ransomware attacks on physical infrastructure 
• Why most are hesitant to become a CISO and the expectations that come with the role 
• Challenges when try to balance technical expertise with leadership skills 

Some questions we ask:     

• Can government or law enforcement agencies evolve in combating ransomware?  
• Where do you believe organizations can invest to improve their cybersecurity? 
• How do you expect ransomware to change with tactics like double or triple extortion? 

Resources:  

View Lauren Proehl on LinkedIn  

View Andrew Morris on LinkedIn     

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Thomas Roccia and Andres Freund. Andres stumbled upon a security issue within SSH while investigating performance discrepancies. He discovered a sophisticated backdoor, skillfully concealed within the LZMA library, part of the XZ package. Sherrod, Thomas, and Andres discuss the importance of proactive security measures and code review in the open-source community. They emphasize the critical role of community collaboration in identifying and mitigating security threats effectively and signal the need for heightened vigilance.  

In this episode you’ll learn:      

• The importance of proactive security and code review in the open-source community 
• Why anomalies in software behavior should prompt curiosity and investigation 
• Open-source community cooperation is vital for spotting and addressing security risks 

Some questions we ask:     

• Could you explain the security issue you found in SSH and its significance? 
• How serious is this threat, and what steps can organizations take to defend against it? 
• What advice do you have for open-source contributors? 

Resources:  

View Andres Freund on LinkedIn  

View Thomas Roccia on LinkedIn     

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.  

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by former VP of Cybersecurity Solutions at Target Paul Melson. Sherrod and Paul reflect on his experiences in incident response, highlighting the adrenaline rush of detecting and evicting adversaries before they cause harm. Their discussion includes a run down the rabbit hole of open-source intelligence and the creation of the @scumbots twitter feed. They explore the culture at Target's cybersecurity team, emphasizing the importance of hiring for attitude and the potential for new threats like bribery and insider threats. Paul shares insights into his experiences in cybersecurity and his concerns about future threats, emphasizing the need for continued vigilance and innovation in defense strategies. The episode provides valuable insights into the challenges and developments in cybersecurity, offering practical advice for both professionals and organizations navigating the ever-changing threat landscape.  

In this episode you’ll learn:      

• The genesis of the project scumbots and its functionality 
• Challenges when dealing with commercial threat intelligence companies  
• The increasing sophistication of cybercrime and the potential for new tactics 

Some questions we ask:     

• How has your time in incident response evolved over the years? 
• What advice would you give to aspiring cybersecurity professionals 
• Do you believe organizations can adapt and innovate their defense strategies? 

Resources:  

Scumbots on Twitter 

View Paul Melson on LinkedIn     

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.