Talos Takes

With another major supply chain attack recently making headlines, we felt like it was a good time to refresh our advice on how to prepare for these types of cyber attacks. Adversaries are increasingly relying on users' inherent trust of the software running on their networks and devices to deliver hijacked, malicious updates that are actually malware. Craig Jackson, a senior Cisco Talos incident responder, joins the show to provide some advice on how organizations can prep for the next major supply chain attack. We also discuss the current, ongoing 3CX situation and how anyone potentially affected could respond now. Other suggested reading:3CX blames North Korea for supply chain mass-hackTalos blog post on the 3CX supply chain attackThe Company You Keep – Preparing for supply chain attacks with Talos IR

Everyone is talking about tools like ChatGPT and other AI tools that are dominating headlines and threatening to upend every industry possible. But where do these things stand in cybersecurity? In this week's episode, Jon talks to two women who are well-versed on the topic and recently presented about the cybersecurity implications of AI at several conferences. Gergana Karadzhova of Cisco Talos Incident Response and Saskia Laura Schroer, a security consulting engineer for Cisco, discuss how AI is currently influencing attackers and defenders. Are attackers already using these tools? Does it give them superpowers? And what questions are still left unanswered about this emerging technology?

It's been just over a year since Talos formed our Ukraine-focused task force. After Russia's invasion of Ukraine, many of our teammates sprung into action to protect critical infrastructure and networks there — not to mention the Talos employees who literally had to fight back to protect their home country. In this week's episode of Talos Takes, J.J. Cummings, one of the lead organizers of this task force, joins the show to discuss the group's ongoing work. J.J. talks about where the situation in Ukraine stands currently, how the cyber threats facing the country have evolved over the past year and much more. To further mark the one-year anniversary of the conflict, Talos has also released a graphic novel illustrating the formation of this task force. Additionally, the latest episode of ThreatWise TV from Cisco highlights the work Talos and Cisco are doing in Ukraine.

Vanja Svajcer and Andrew Windsor join the show this week to talk about their recent research into the Prometei botnet. This malware continues to evade detection and invade more machines so it can eventually hijack them to mine Monero cryptocurrency. Jon asks them about what's new with Prometei, why it's pretty generous in who it's targeting and where we could see it going next. Additional reading

Public perception is such that it's assumed we just get more spam in the U.S. during two major times of the year — Tax Season and Black Friday. But over the past few years, this trend has become a thing of the past. With Tax Day approaching for Americans, there won't be more spam emails coming their way than usual, it'll just be different. Eric Peterson from Talos' email detection team joins the show for Jon's triumphant return from parental leave to talk about tax-related spam. Eric talks about topics he's seen so far this year and why it's a myth that spam volume changes as Tax Day approaches.

Nick Biasini is back as host again to talk to Vitor Ventura about the benefits of taking an active approach to threat defense. Many organizations may just sit back and wait for something bad to happen. But as he outlined in his recent blog post, Vitor says there are many benefits to being proactive instead of reactive. Nick asks him about threat hunting as a team, scanning logs and tracking network traffic on an almost-constant basis.

We're back with the final year in review focused episode. This time the focus is on the ever broadening ransomware landscape and the commodity malware loaders that often support it. I'll be joined by one of the researchers from the year in review report, Aliza Johnson to talk about what we saw on the ransomware landscape over the last year as well as how threats like Qakbot, IcedID, and Trickbot have changed and evolved over the last year. We'll also cover how these threats overlap and how LoLBins are yet again an area of concern.

In this episode of Talos Takes I am joined by security researcher Guilherme Venere to discuss their recent research on LNK files. The usage of these files by malicious actors has exploded over the last six months as actors look to move away from macro based initial infection vectors. LNK files do have unique metadata attributes to allows for useful actor and threat tracking capabilities. We'll dig deeper on LNK files as well as the metadata you can leverage. For full details check out the blog at https://blog.talosintelligence.com/following-the-lnk-metadata-trail/

We're back with another year in review focused episode. This time the focus will be the threat landscape generally and I'll be joined by threat researcher Caitlin Huey. In this episode we'll discuss what we found in the last year, with a focus on the general threat landscape. We'll spend time discussing dual use tools, lolbins, and the surprising re-emergence of USB attacks in 2022.

In this episode of Talos Takes we are joined by Vanja Svjacer to discuss his recent blog on XLL abuse. This year Microsoft finally removed support for macros from their office suite creating a vacuum in the threat landscape. Macros had been the tool of choice for adversaries for the last several years and the race to find alternatives is underway. In this episode we'll talk a bit about Office Add-Ins and how we've already seen adversaries starting to abuse XLL files in the wild.

In this episode of Talos Takes we are joined by Jacob Finn to discuss the APT summary section of the larger year in review report. These state sponsored actors tend to conduct more sophisticated, targeted campaigns typically related to espionage or other information gathering activities. This episode will dive a bit deeper on what can be found in the report as well as an overview of the state sponsored activity we've observed from the last year.

In this episode of Talos Takes we are joined by Tiago Periera to discuss his recent blog on truebot activity. Truebot and the silence group have been active for a number of years operating primarily financially motivated cybercrime. In this episode we will talk about the recent campaign we observed as well as the tools and tactics we uncovered. We'll also discuss the links between these groups and other threat actors, like TA505.

In this episode of Talos Takes we are joined by Kendall McKay to discuss the recently released year in review report and dig deep on our activities in Ukraine. The year in review covers a vast amount of data and intel sources to identify some of the key trends we observed in 2022. Our activities in Ukraine have been well documented, in this episode we'll also talk more broadly about the trends and highlight some key findings from the past year.

LodaRAT is an AutoIT based RAT that has been distributed for the last several years. Initially tied to the Kasablanka group its distribution has grown over the years. In this episode we'll be talking with the researcher, Chris Neal, to discuss LodaRAT, the campaigns we've been observing along with some key tidbits about how AutoIT is abused by adversaries. Including some fun with decompiling and recompling.

InterPlanetary File System or IPFS has increased in prominence as a file hosting technology associated with Web 3.0. It's probably most well known for hosting NFTs, but this blockchain related technology is also being abused by bad actors. In this episode we'll be talking with Edmund Brumaghin about his recent research into IPFS and his findings. We'll also talk about the ways we've seen malicious actors abuse it and briefly touch on things organizations can do to protect themselves.

To wrap up Cybersecurity Awareness Month, we're looking at the best, and free, ways to improve your security skills. Jason Kirkland and David Roman from Cisco Talos Incident Response join Jon to talk about the websites, YouTube channels, social media profiles and more they use to stay up-to-date on security news and polish their cybersecurity skills. Here are links to some of the resources we spoke about in this episode:@SwiftOnSecurity@CISAgovBlue Team Village DiscordThe Definitive Compendium ProjectDigital Forensics & Incident ResponseFind your local BSides chapterDFIR DivaTryHackMeR/NetsecThirteen3Cisco Talos YouTube page

To celebrate this week's National Cybersecurity Awareness Month theme, we have a special 101 episode of Talos Takes to cover the basics of threat hunting. This is a crucial skill for any cybersecurity professional-in-training and one of the questions we get the most often. Asheer Malhotra from the Talos Outreach team joins the show to talk about where he starts finding new malware families and threat actors, what the barriers usually are that he has to overcome and what check boxes he has to hit before he can talk about something publicly. For more on this topic, watch our "Threat Hunting 101" livestream from earlier this week here.

To celebrate National Cybersecurity Awareness Month, two one-time "security noobs" talk about their career trajectories and how they've grown to see themselves in cyber. Sammi Seaman and Jon Munshaw talk about their previous careers in library services and journalism, respectively, and how they applied some of those skills to cybersecurity. Other talking points include:Cybersecurity "ah ha!" moments.Not being afraid to ask questions.Free ways to expand one's cybersecurity knowledge.The importance of getting involved in local cybersecurity conferences and non-profits.

Azim Khodjibaev joins the show once again for the latest addition of "Days of our Ransomware." Jon and Azim talk about the recent LockBit 3.0 leaks and the drama surrounding them. Will other actors try to backpack off the leaked builder? Why is LockBit switching to triple extortion tactics now? And what other trends are going on in the ransomware landscape? This is the perfect place to get caught up on all things ransomware to head into the rest of National Cybersecurity Awareness Month.

Nick Biasini is back on once again to talk to Jon about Insider Threats. Nick recently wrote a post about how he and Cisco Talos Incident Response are seeing an increase in these types of attacks in the wild. And while the term "insider threat" may sound like someone actively seeking to do something bad, that's now always the case. This week's episode discusses how to prepare for Insider Threats and some of the hallmarks of the spam emails, calls and mobile notifications we're seeing in these campaigns.

Vitor Ventura from the Talos Outreach team joins the show this week to run down Talos' recent research into the Lazarus Group. This well-known North Korean state-sponsored threat actor is well known for their ransomware and cryptocurrency-related cyber attacks, but we recently found them launching a new information-stealing trojan targeting energy companies. Vitor talks about the new trojan, MagicRAT, and how it fits into their larger plans and motivations.

Guilherme Venere of the Outreach team joins Jon this week to discuss the Gamaredon APT group. This Russian state-sponsored actor is infamous at this point in its life, but it keeps growing by adding new tools and malware. Recently, Guilherme helped to discover a new campaign targeting users and organizations in Ukraine, a common target of Gamaredon since the onset of Russia's invasion. They discuss what's unique about this particular attack, and why we can't just assume their activities will stay isolated to Ukraine for the time being.

We're headed back to school with Talos Takes again! Pierre Cadieux from Cisco Talos Incident Response joins the show to talk about advice for educational institutions. Jon asks him about common incident response advice for the education sector and we cover security advice for school admins, parents and students who have to worry about electronic devices traveling to and from school and connecting to all sorts of networks. This episode is particularly relevant this week given some recent major cyber attacks against the education sector, including a major event at the combined Los Angeles school district.

This week, we have the audio version of our recent livestream for Ukraine Independence Day. Talos assembled a panel of experts who have been working hands-on to defend critical Ukraine systems and its citizens from cyber threats. JJ Cummings, Ashlee Benge and Dmytro Krozhevin answer questions from Hazel Burton about the current security threats Ukraine faces, what Talos has done to hunt for threats in the region and how Cisco is supporting its employees in Ukraine.

An underrated aspect of Russia’s invasion of Ukraine is the effect it’s had on the global food supply chain. Ukraine is a major importer and exporter of grain and other food staples, but the industry now faces kinetic and cyber threats. Joe Marshall of Talos has spent months learning all about agricultural cybersecurity and the unique position farming equipment and infrastructure is in. Joe recently wrote about these threats for the Talos blog and joins Talos Takes to talk about how important Ukraine is to the global food supply chain and what law enforcement and global governments can do to prepare for potential state-sponsored attacks.

The public traditionally thinks about cyber attacks as being from some well-funded, state-sponsored actor. But increasingly small-time criminals are turning to the internet to make their money. Increasingly, they’re not carrying out one-off robberies, and instead are working on insurance fraud scams and spam emails. Nick Biasini joins Talos Takes this week to discuss his recent research into this topic and shares what the data shows about the growth of small-time cybercrime.

It’s National Cyber Security Awareness Month! And you know what that means? It’s time to make everyone more aware! Since we all have that special someone in our lives who could use a refresher on internet hygenie, we figured it was time to talk about bringing up the topic of security to your friends and family who may not be as computer literate as you are. Jon Munshaw and Nick Biasini talk about basic tips to give even your oldest family members and user-friendly programs and services that can improve everyone’s security.

On this episode of Talos Takes, we talk all about attribution. Our guest, Martin Lee, recently co-authored a post on the hurdles government agencies and private researchers alike face when trying to place blame for a cyber attack. Martin talks about why we’re so obsessed with placing the blame, what false flags are and what helpful things can actually come from attributing a threat.

LoLBins sound like they’d be funny, but they’re anything but. These “living-off-the-land binaries” make it so that attackers can more easily hide on your system as they disguise themselves as legitimate processes. On this episode of Talos Takes, Nick Biasini talks about what LoLBins are, exactly, how adversaries use them and how you can spot them on your environment.

With the Equifax attack back in the headlines, we take a closer look at Big Game Hunting this week on Talos Takes. Why do threat actors look at these massive targets, and what do they hope to get out of it? Is there anything smaller organizations can learn from these high-stakes campaigns?

Earlier this week, we released an in-depth blog post on fingerprint scanners used as physical security gates on devices. To save you a bit of time, and to summarize it for those non-technical folks out there, Nick Biasini and Jon Munshaw dedicate this episode to breaking down Talos’ research. What was the endgame of our research? And can you rely only on your fingerprint to keep your device secure?

Now that Cisco Incident Response has been a part of the Talos family for a few months now, we figured it was time to check back in with them. On this episode of Talos Takes, Brad Garnett from CTIR joins the show to talk about his organization’s new Cyber Range offering, part of the standard CTIR retainer. Brad discusses how a Cyber Range exercise can prepare your organization for the worst and how it helps dispel some myths around what happens during a cyber intrusion.

On this week’s episode, Edmund Brumaghin joins the show again to talk about a recent blog post on Salfram. This threat actor is spreading lots and lots of spam and using it to deliver a variety of malware. Here’s why this threat specifically caught our eye and how it’s evolving over time.

In this episode of Talos Takes, content manager Jon Munshaw sits down with researcher Joe Marshall to discuss the recently discovered EKANS/SNAKE malware. This is one of the first ransomware strains to specifically target ICS systems. And Joe, who has experiencing protecting the ICS space, discusses what’s unique about this family and what it means for the future of cyber security in the infrastructure field.

It’s been a while since we re-visited our Malware 101 series. So we’re going back to class to learn about information-stealers. Aliza Johnson from the Talos Threat Intelligence & Interdiction team joins the show to talk about her recent research into and overview of infostealers. Although the name is pretty self-explanatory, this type of malware comes in many shapes and sizes for many purposes.

We go back to college this week with a Psychology 101 class. And today, we’re covering multi-factor authentication. Jon has Dave Lewis, one of Cisco Duo’s advisory CISOs, on the show to talk about the psychology behind using these apps and talking to users about implementing it across their environments. They discuss moving around the accept and reject buttons in the UI, how we communicate the benefits of MFA to administrators and the recent wave of brute-force attacks.

Paul Eubanks joins this week’s episode of Talos Takes to look at his recent blog post on de-anonymizing ransomware groups on the whispers dark web. Paul and his team recently used several tactics to unmask several threat actors and disclosure their tactics to stay hidden. Jon interviews Paul about ransomware actors’ usual operations on the dark web, the specific tools and tactics he used and the pros and cons of calling out actors for their opsec failures.

See people, this is what happens when you finally let a panda drive a sports car! This week’s episode of Talos Takes covers the basics of MustangPanda, a Chinese state-sponsored actor we wrote about recently. Asheer Maholtra joins the show to go over his research into this group. Mainly, we discuss why this actor, despite being aligned with China, is targeting Russian government entities and organizations. Though the two countries seem to be allies, all is fair in love and cyber espionage.

Continuing the “Kenna 101” series over at Talos Takes, Ed Bellis re-joins the show to talk about patching and mitigation strategies. So far, we’ve talked about how to tell when you should take a CVE seriously. But what if there’s no patch for it? Or what if you have to patch 50 vulnerabilities in the same product? We talk about how Kenna can help security teams of all sizes prioritize their patching strategies and create mitigation strategies in the worst-case scenario. For the other entries in our Kenna 101 series, listen here and here.

When most people think of the “Metaverse,” they may first think of the company Meta — the recently rebranded Facebook. After all, what other company would really want everyone taking meetings virtually using avatars while you share your cryptocurrency wallets and personal information with them? The Metaverse is actually much larger than this, though. So in this Talos Takes episode, we’re trying to demystify the Metaverse and look at what it is, exactly. Researcher Jaeson Schultz recaps his recent blog post on the matter, and then he and Jon talk about the potential security pitfalls that could arise from adopting the Metaverse.

In the latest entry in the “Days of our Ransomware” series, Azim Khodjibaev joins Jon to talk about some recent ransomware drama. Dark web forums have been going nuts since Russia arrested and charged several alleged members of the REvil ransomware gang in January. Azim discusses how there’s been a power grab since those arrests, and we discuss what else it might take to shut down many of these wide-reaching ransomware groups. Threat actors: They get into the same petty arguments we all do in Slack.

We had to give Brad a few minutes to take an Incident Response victory lap after his team received two major accolades over the past two weeks. But aside from that, it’s also a perfect time to have him on ahead of the holidays. The shopping season is always a favorite time for attackers, so it’s as good a time as any to make sure your incident response plan is polished and practiced. We also take some time to look back on what Incident Response lessons Brad learned in 2021.

Sorry for dropping two episodes in the feed in one day, but we also needed to find time to talk about the critical zero-day vulnerability in Apache HTTP Server. An attacker could exploit this vulnerability to perform path traversal and eventually remote code execution. Patch for this one as soon as possible, and use the Snort rule we have available now.

We have another special extra large-sized version of Talos Takes this week. Enjoy this recording of a live stream we hosted earlier this week with Martin Lee from our Talos Communications team and Paul Lee from Cisco Talos Incident Response. The Lees discuss how to build the perfect Incident Response Plan. First, Martin walks through the basics of creating, editing and iterating on an IR plan. Then, he’s joined by Paul to ask him a few questions, take some Q&A from the audience and learn about Paul’s experience from the field.

Asheer Malhotra joins the show to once again cover a cyber attack in South Asia. This time, it’s an attacker that looks and smells like an APT, but may just be a run-of-the-mill crimeware gang. Asheer discusses he and his colleagues’ research into Operation: Armor Piercer, a campaign targeted at government agencies and military contractors. Needless to say, these are high-profile targets. Find out what this group wants and why they’re aping so much from other groups like Transparent Tribe and SideCopy.

Allow Vitor Ventura to take you on a journey of discovery, threat actors and attribution. He recently assisted with an investigation into a series of malware and spam campaigns using aviation-themed lures. These include fake flight itineraries, invoices and more. Vitor joins us on this week’s Talos Takes episode to discuss what he learned during this process, including how he connected the campaigns, what he learned (and couldn’t learn) about the actor behind them, and what he’ll take away into his next research. This is a great episode for anyone who is wondering about what kinds of pitfalls are out there for a security researcher.

Andrew Windsor from our malware research team joins the show for the first time to talk about Solarmarker. This is a campaign Andrew’s followed for a while that recently added new modules that make it particularly dangerous. The attackers behind Solarmarker could basically use this threat to drop whatever they want. At least for now, they’re sticking to information-stealing. But could it ever get worse than that?

We started out the COVID-19 pandemic by thinking we’d be away from the office for a month — maybe two. More than 12 months later, we’re still here, working from home (at least part-time).But some businesses are starting to reopen now and welcoming workers back into the office. After so much time working out of the office, what should security professionals do once they get back? In this week’s episode, Beers with Talos’ own Craig Williams joins the show to talk about triple-checking for patches, changing passwords and more. Plus, how should you handle the new hybrid worker?

For this week’s episode of Talos Takes, we’re switching back to Snort talk. For anyone who hasn’t been on security Twitter over the past month, you may not know that we released the Snort 3 GA last month — formally known as Snort 3.1.0. To celebrate, Nick Mavis joins the show again to discuss Snort 3’s new features and upgrades over 2.9.X. Nick, who regularly writes Snort rules for Cisco Talos and has been working hands-on with both versions of Snort for years, talks about how the rules improve with Snort 3, why detection and protection are better and everything else he loves about Snort 3. For more, check out the Snort 3 page on Snort.org.

Everyone is meeting virtually now. Whether it be important business or the average happy hour with friends and family, there’s no shortage of invites to chat rooms, presentations and software you’ve never heard of before you started working from home. And, of course, this software comes with its own set of security concerns and vulnerabilities. So Matt Valites joins Jon Munshaw this week to talk about the basics of securing your next friendly meetup or presentation to the board.