DISCARDED: Tales From the Threat Research Trenches Operation EndOfYear: New Malware, Popular Tactics, and Where AI Is Taking Us
Hello to all our Cyber Elves! Host Selena Larson chats with Daniel Blackford, Vice President of Threat Research at Proofpoint, for an end-of-year look at how the cyber threat landscape evolved—and what defenders should be preparing for in 2026.
They reflect on how the second half of 2025 brought meaningful shifts in attacker behavior, with familiar techniques becoming more professionalized and new malware emerging alongside identity-focused attacks. The conversation also explores why attribution is getting harder, how law enforcement disruptions are reshaping cybercrime ecosystems, and where AI is genuinely helping defenders versus introducing new risks.
In this episode, they cover:
- How attacker tactics “proliferated” in 2025 rather than fully reinvented
- The return of new malware families alongside loaders and backdoors
- Why identity, social engineering, and legitimate tools (RMMs, device code phishing) remain top attack vectors
- The real-world impact of law enforcement takedowns like Operation Endgame
- How shared tooling and services are blurring attribution across threat actors
- Practical, no-hype perspectives on AI, machine learning, and defender workflows
- What organizations should focus on now to stay resilient in 2026
This episode offers a grounded, experience-driven perspective on what actually mattered in 2025—and why strong fundamentals, layered defenses, and adaptability remain the best preparation for whatever comes next.
Resources Mentioned:
https://www.proofpoint.com/us/blog/threat-insight/operation-endgame-quakes-rhadamanthys
https://www.proofpoint.com/us/blog/threat-insight/security-brief-venomrat-defanged
https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-ru-2025-1022.pdf
For more information about Proofpoint, check out our website.
Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!