Risky Business Risky Business #819 -- Venezuela (credibly?!) blames USA for wiper attack
51 snips
Dec 17, 2025 Josh Kamdjou, CEO of Sublime Security, dives into the evolving landscape of phishing, particularly focusing on calendar invite threats. He uncovers how these invites can bypass traditional email defenses, turning into a medium for malware distribution. Kamdjou also discusses Sublime's innovative solutions to combat these attacks and enhance user safety. The conversation highlights the alarming rise in industrial control systems phishing and the need for agile responses in a rapidly changing threat environment.
AI Snips
Chapters
Transcript
Episode notes
OAuth Flow Abuse Via Localhost Callbacks
- Attackers abused the Azure CLI OAuth flow by tricking users into pasting a localhost callback URL containing key material.
- That social-engineered callback gives attackers CLI access equivalent to broad Microsoft 365 privileges.
Attribution Complexity Around PDV Attack
- Venezuela's PDV cyber incident could be ordinary ransomware or a deliberate state-linked operation; obvious political attribution is uncertain.
- Context like recent tanker seizures and timing makes a covert state action plausible but unproven.
State-Sponsored Hacktivism Often Yields Noise
- State-funded hacktivist operations often produce low-impact, noisy incidents that question strategic value.
- Many alleged Russian-backed operations produced petty disruptions like fountains and car washes rather than decisive effects.