The Defender's Advantage Podcast

Host Luke McNamara is joined by GTIG Senior Security Researcher Rohit Nambiar to discuss Rohit's recent blog on some interesting usage of RDP by UNC5837. Rohit covers the discovery of the campaign, and the novel functionalities they were using to likely support cyber espionage goals. He delves into these findings and the usage of RemoteApps and victim file mapping via RDP, and closes with some of the mysteries that remain about this activity. https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol

Imran Ahmad, Senior Partner and Canadian Co-Head of Cybersecurity at Norton Rose Fulbright, dives into the shifting landscape of cyber risk management. He emphasizes the imperatives of proactive training before breaches and how ransomware has altered boardroom discussions. Ahmad discusses the growing importance of educating executives on cybersecurity strategies and the rise of threats like AI-driven corporate espionage. He also addresses how organizations must adapt to sophisticated threats, stressing the need for collaboration among legal and technical teams.

Kelli Vanderlee, Kate Morgan, and Jamie Collier join host Luke McNamara to discuss trends that are top of mind for them in tracking emergent threats this year, from nation state intrusions to financially motivated ransomware campaigns. https://cloud.google.com/security/resources/cybersecurity-forecasthttps://cloud.google.com/blog/topics/threat-intelligence/cybercrime-multifaceted-national-security-threat

Dan Black, Principal Analyst at the Google Threat Intelligence Group, dives into the chilling world of Russia-aligned cyber threats, particularly focusing on Signal Messenger. He explains the shift in Russian cyber tactics from civilian targets to military priorities, highlighting their use of espionage. Black discusses how Ukrainian forces rely on encrypted apps amid rising threats like malware and phishing. He also shares essential cybersecurity practices for users to protect themselves, emphasizing the importance of vigilance in the evolving digital battlefield.

Steph Hay (Senior Director for Gemini Product and UX, Google Cloud Security) joins host Luke McNamara to discuss agentic AI and its implications for security disciplines. Steph walks through how generative AI is already impacting the finding of threats, reduction of toil, and the scaling up of workforce talent, before discussing how agents will increasingly play a role in operationalizing security. Steph details how this automation of processes, with humans in the loop, can increase the capabilities of an enterprise in cyber defense. 

Jibran Ilyas (Consulting Leader, Mandiant Consulting) joins host Luke McNamara to discuss remediation as part of incident response. Jibran covers various scenarios (espionage and ransomware) and how they may differ in approaching remediation, how types of architecture could shape remediation efforts, non-technical components of the remediation phase, and more. 

Mandiant Senior Consultant Alishia Hui joins host Luke McNamara to discuss all things tabletop exercise related. Alishia walks through the elements of a tabletop exercise, important preparatory steps, the success factors for a good exercise, and how organizations can implement lessons learned. https://cloud.google.com/transform/the-empty-chair-guess-whos-missing-from-your-cybersecurity-tabletop-exercisehttps://www.mandiant.com/sites/default/files/2021-09/ds-tabletop-exercise-000005-2.pdf

Vicente Diaz, Threat Intelligence Strategist at VirusTotal, joins host Luke McNamara to discuss his research into using LLMs to analyze malware. Vicente covers how he used Gemini to analyze various windows binaries, the use cases this could help address for security operations, technical challenges with de-obfuscation, and more.For more on this topic: https://blog.virustotal.com/2023/04/introducing-virustotal-code-insight.htmlhttps://blog.virustotal.com/2024/04/analyzing-malware-in-binaries-and.html

Josh Fleischer, a Principal Security Analyst with Mandiant's Managed Defense organization, dives into the alarming trends of multi-factor authentication (MFA) bypass in this discussion. He reveals how adversary in the middle attacks exploit vulnerabilities, particularly through advanced phishing tactics. Josh highlights the rise of 'phishing as a service,' automation in spear phishing, and the risks posed by QR codes. He emphasizes the critical need for robust MFA solutions amid evolving threats and shares insights on detecting and remediating digital threats.

Host Luke McNamara is joined by Clement Lecigne, security researcher at Google's Threat Analysis Group (TAG) to discuss his work tracking commercial surveillance vendors (CSVs). Clement dives into the history and evolution of the CSV industry, how these entities carry out operations against platforms like mobile, and the nexus of this problem into the increasing rise of zero-day exploitation. For more on TAG's work on CSVs:https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/https://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/https://blog.google/threat-analysis-group/googles-efforts-to-identify-and-counter-spyware/