Cloud Security Podcast by Google EP211 Decoding the Underground: Google's Dual-Lens Threat Intelligence Magic
5 snips
Feb 17, 2025 Kimberly Goody, Head of Intel Analysis and Production at Google Cloud, dives into the fascinating world of threat intelligence. She shares how Google's Threat Intelligence Group uniquely combines underground forum data with incident response insights to identify cybercriminal campaigns. Goody explains the challenges of attributing attacks to specific actors and the importance of contextualizing threats. The discussion also highlights the role of AI in enhancing threat analysis and the collaborative efforts across Google's teams to strengthen security.
AI Snips
Chapters
Books
Transcript
Episode notes
Dual-Lens Threat Intelligence
- Google's Threat Intelligence Group (GTIG) leverages both underground forum data and incident response information.
- This dual perspective allows them to prioritize impactful threats, contextualize attacks, and proactively monitor threat actors.
FIN11 Attribution Example
- A suspected FIN11 attack targeted a vulnerability in Clio's secure file transfer sharing products.
- GTIG used similarities in malware configuration, infrastructure, and public claims on the CLOP data leak site to attribute the attack with increasing confidence.
Shadow Ladder Discovery
- An analyst discovered the "shadow ladder" cryptor by manually scrolling through posts on the Exploit forum.
- A demo video linked to live malware, confirming its connection to observed attacks, highlighting the role of both meticulous research and chance.
