Talos Takes

We’ve been covering several different generic types of malware over the past few weeks. Next up, we’ve got our overview of remote access trojans (or tools), also known as RATs. What goes into a RAT, and how is it different than other types of malware? What are some of their inherent capabiliites? We/ve got the rundown here.

With the RSA conference just days away, notable vendors such as IBM and AT&T have withdrawn from the annual event over coronavirus concerns. The fast-spreading disease has captured headlines across the globe, and adversaries are trying to strike quickly. Continuing our look at attackers’ use of current events to spread malware, Nick Biasini and Earl Carter sit down to discuss malware campaigns that are hoping to scare victims into opening malicious emails and documents on coronavirus.

We’ve all seen the supposed stories online that promise to give you “The one secret to weight loss doctors WON’T tell you about.” Or “You won’t believe who Kim Kardashian is talking about now.” So how harmful are these malicious ads? Why do some of them deliver malware, and others don’t? In this episode of Talos Takes, Nick Biasini and Earl Carter dive into the basics of malvertising.

Snort researcher and rule-writer Nick Mavis takes time out of his busy schedule to join us again this week. Nick recently published a research paper on the bevy of detection he wrote for Cobalt Strike, a tool attackers are increasingly using. Nick talks about his process of working on the paper, why Cobalt Strike has become so popular and what he learned during the research process.

Yes, this is the third time we’ve talked about Transparent Tribe on Talos Takes, you’re not going crazy. But they keep giving us reasons to bring them up! This time, Nick Biasini joins the show to discuss the latest evolution of this threat actor: The targeting of higher education institutions in India. Jon and Nick discuss why colleges are always a high-priority target and what this could mean for the evolution of the actor.

BlackCat, BlackMatter, DarkSide, BlackByte…it’s too hard to keep up with all these ransomware group names these days. So we’re here to break down one of these groups, BlackCat, for you so you can figure out what makes them actually memorable. Aliza Berk from our Talos Threat Intelligence & Interdiction team joins Jon Munshaw this week to talk about BlackCat and their ransomware that’s recently become a major player on the malware landscape. Aliza recently compiled our latest Threat Assessment Report on this group and assisted in our research around the group. Jon and Aliza discuss how the use of the Rust programming language and using triple extortion tactics make this group a threat.

We’re kicking off a new series of episodes called “Kenna 101” highlighting Cisco’s newest partner, Kenna Security. Kenna is a risk management platform for vulnerabilities that allows users to view what vulnerabilities exist in their environment and helps them create a plan for patching and mitigation. We’re starting things off with the CTO of Kenna, Ed Bellis, to talk about the basics of Kenna and its risk scores.

As the Ukraine situation evolves, we figured it was an important time to check in with the specific threats government agencies across the globe have started to warn us about. Joe Marshall, Talos’ resident industrial control systems expert, joins this week’s episode of Talos Takes to talk about potential threats to Ukraine’s power grid should kinetic warfare break out in the area. We also touch on what potential threats America’s infrastructure faces if our government leaders were to oppose any Russian actions in the region. It’s admittedly a tangled web currently — but for the most current information on this, check out the Talos blog on the topic.

We are from the first (or last) people to say this, but 2021 is the year of ransomware. It’s by far the biggest story on the security landscape right now. And everything from oil pipelines, to grain co-ops, to hospitals and schools have been targeted by ransomware this year. Azim Khodjibaev joins the show for National Cybersecurity Awareness Month to wrap up everything we’ve seen on the ransomware landscape this year. Azim reflects on his interview with a LockBit operator, the research he’s done into “double extortion campaigns,” and discusses the lessons defenders can learn from the past 10 months.

As more people around the world start to get vaccinated against COVID-19, travel is becoming easier, especially during these summer months. But as much as you may be excited to travel, so are threat actors. Asheer Malhotra was part of a team that looked into a series of campaigns targeting users in Latin America, specifically using social engineering tactics centered around travel. Some of the lure documents, in this case, include fake travel itineraries, coupons for flights and hotel reservation confirmations. Asheer joins the show this week to discuss the throughline between all these attacks and their potential connections to the Aggah crimeware group.

Students are starting to go back to school across the U.S. There are plenty of things to worry about with the “new normal” while the world still combats COVID-19, and while we can’t help students, teachers and admins with everything, we can at least provide a little security advice. Nick Biasini joins the show once again to discuss the best cybersecurity practices as schools spin back up. What should parents tell their kids about electronic devices they bring home? What will IT admins have learned over the past year and a half plus? And how should we deal with the new norm of hybrid learning?

Everyone loves to talk and write about how tough it is that we are all working remotely during the COVID-19 pandemic. So for once — to celebrate National Cybersecurity Awareness Month — Talos Takes wants to talk about the positives! Christopher Marshall, the head of Talos’ detection research team, joins the show to discuss how he’s kept his team’s morale up during this time. Cybersecurity is a rough industry to be in, regardless of any external factors. So it’s important for him to avoid employee burnout and turnover. He and Jon also discuss the positives of working remotely, what they’re most looking forward to when they can go back into the office and their favorite pandemic-era hobbies.

This is a double special Talos Takes episode — it’s XL-sized and continues our Cybersecurity Awareness Month theme. This is a recording of our live stream from earlier this week with Brad Garnett, the general manager of Talos Incident Response. Even if you’ve never worked with an incident response team before, or have no idea what IR is, this is a perfect place to start. We provide the tl;dr of the IR process, talk building an IR plan and answer audience questions.

What’s a commodity RAT? And how does that make it different from your run-of-the-mill RAT? Is that RAT different than a trojan? In this week’s Talos Takes episode, we answer these questions and more to provide you a quick overview of remote access trojans/tools (aka RATs) and how commodity RATS specifically differ from their “normal” brethren. Asheer Malhotra from our Outreach team has been looking at several commodity RATs for months now and is here to take you to class for 10 minutes.

Jon and Nick sit down for a few minutes to talk about U.S. President Joe Biden’s recent Executive Order on more heavily regulating cryptocurrency. For a primer on this episode, you can read a quick overview here. This episode pretty much sums it up as being a good thing for anyone who uses cryptocurrency legitimately, and bad for anyone who uses crypto to do anything illegal. We discuss how greater regulation could affect ransomware operators who rely on virtual currency for ransom payments and illegitimate miners, and why no one using Bitcoin legitimately should be worried.

Continuing our “Kenna 101” series, Jon is joined this week by Jerry Gamblin, Kenna’s director of security research. Jerry is an expert at all things CVE’s, so we reflect on reading vulnerability reports and analyzing specific CVEs. We discuss if “severity” scores even really mean anything, and how to interpret a maximum 10/10 score versus an attacker vector or type of vulnerability.

We’ve spent many minutes (that’s the point of the podcast, after all) discussing internet-of-things devices on this podcast. As consumers start having more “smart” devices connected to their home network, they may want an easy solution to keeping those devices safe. But what if that device gets owned?Carl Hurd of our vulnerability research team recently discovered several vulnerabilities in Trend Micro’s Home Network Security Station. He joins the show for the first time to talk about his research, the pros and cons of these all-in-one home network security devices, and how an attacker could exploit these issues to spy on your devices.

With major cyber attacks in recent years against major U.S. critical infrastructure suppliers like Norsk Hydro and Colonial Pipeline, we’re in a new world of CI cybersecurity. New threats require new approaches to defense. And in the U.S., this is likely going to include partnerships between those who manage critical infrastructure, government and the private cybersecurity sector.Talos recently outlined what this may look like in America. One of the authors of that post, Joe Marshall, joins Jon Munshaw this week on Talos Takes to talk about public-private partnerships to defend critical infrastructure.

Asheer Malhotra from Talos Outreach has followed Transparent Tribe for years now. This APT has been all over the place using all sorts of trojans. So where my they go next? Asheer joins Talos Takes this week to discuss the malware this group deploys and how they use typo-squatted domains to lure victims in.

In this special “XL edition” of Talos Takes, we’re bringing you the audio version of our live stream this week discussing the Kaseya supply chain attack. Nick Biasini from Talos Outreach went live with Hazel Burton, a Cisco product marketing manager, to discuss what transpired over the long Fourth of July weekend. Nick discussed the Kaseya exploit leveraged in this campaign, plus the follow-on ransomware attacks. This is the best place to get the tl;dr on what happened, what you need to be doing now, and what Cisco Secure solutions can keep you protected.

To celebrate World Password Day this week, we’re talking about getting rid of passwords! Dave Lewis, a global advisory CISO for Cisco Secure, joins Jon to talk about all things passwordless. This is a new initiative Cisco Secure and Duo have undertaken to get network administrators to move away from using passwords in favor of other forms of authentication. Jon and Dave discuss why passwords can be dangerous, the benefits of going passwordless and how to convince longtime users to ditch traditional login credentials.

Cisco Talos recently discovered a wave of attackers spreading malware via collaboration apps like Discord and Slack. On this week’s episode of Talos Takes, Nick Biasini joins the show to bring us inside his research process for this post and discuss why these attacks have been so successful. Jon brings up his Dungeons & Dragons group, too, if you’re interested in that sort of thing.

Everyone had jokes when it came to the vulnerabilities we recently disclosed in a WiFi-connected air fryer. But there are actually some lessons to take away from this, such as: “Not everything needs to be connected to the internet.” Joe Marshall joins the show this week to discuss all things “smart” appliances, how to protect your network and the repercussions of these specific air fryer vulnerabilities.

Chris Neal from Talos Outreach has followed LodaRAT for years now. It’s gone from a fairly small threat to a full-on malware with several features that target all sorts of Android devices. Chris joins the show this week to discuss his history of researching LodaRAT and updates us on its latest TTPs. Find out how this trojan tries to trick users into downloading it on their phones and how it hunts for your banking information.

After researching and writing about ObliqueRAT for several months now, Asheer Malhotra joins Talos Takes for the first time to discuss this trojan. We’ve seen this malware evolve over the past year or so to ad new evasion techniques and find ways to avoid email filters and usual antivirus protections. Asheer talks about his history researching this malware and provides some advice on how to avoid email spam and the other maldocs these actors try to spread.

Welcome to the first-ever XL edition of Talos Takes. This one is a little longer than usual, but we promise you it’s worth it. We recently brought together researchers from all corners of Talos to talk about what we know about SolarWinds so far, and what’s still to be discovered. Our various teams have spent the past several months diving deep into the SolarWinds supply chain attack, and this is a collection of Talos’ knowledge on the current situation. Talking points include whether it’s fair to refer to this campaign as “SolarWinds,” what other initial infection vectors there may be, the breadth of the attack and more boots-on-the-ground intelligence. If you want to watch the video version, head to our YouTube page.

When Pierre Cadieux steps into a Cisco Talos Incident Response engagement, the first thing he wants to do is check out the customer’s logs. But if there are no logs to be found, he’ll be pretty limited in the kinds of insights he can provide.This has come up several times during the SolarWinds era, when customers are wanting to know if they were targeted in the widespread supply chain attack. So in this episode of Talos Takes, Pierre joins the show to discuss why it’s so important to keep logs for everything — log-ins, events, applications and more.

For the first time in Talos Takes history, we have a whopping TWO guests on to talk about Talos’ latest research paper. In this episode, Dmytro Korzhevin and Azim Khodjibaev discuss their work interviewing a LockBit ransomware operator. They spent multiple weeks speaking to this actor over social media, and eventually turned their conversations into a paper that lays out what we learned about the ransomware landscape. Dmytro and Azim talked about lessons learned, what surprised them about the threat actor, and how actors choose their targets.

The major SolarWinds campaign has been generating headlines for weeks now. And while its specific targets make this attack unique, this is far from the first-ever supply chain attack. So what is a supply chain attack? And should your organization be prepared for them? In this episode of Talos Takes, Nick Biasini talks about the history of supply chain attacks, and how they can even be traced back to the 1970s.

Everything was on fire this year, and the internet was no different. Ransomware was the leading cause of headaches and late night for defenders and IT experts this year. On the latest Talos Takes episode (and last of 2020), Azim Khodjibaev joins us to talk about ransomware’s big year. We talk about why adversaries wanted to go big-game hunting, and what this could mean for trends in 2021.

More shoppers are expected to buy online this year than ever. Everyone’s encouraged to stay home and avoid lines and crowds due to the COVID-19 pandemic, which has left retailers offering deals earlier in November than ever before. So how can you stay safe while doing all your holiday shopping online? In this episode of Talos Takes, we’ll talk through some of the common schemes we’re seeing and talk about what makes this year unique when it comes to spam campaigns.

Talos intakes a ridiculous amount of information every day. So how do we parse what is and isn’t important enough to share? In this episode of Talos Takes, Amy Henderson from our Threat Intelligence and Interdiction team talks about our information-sharing partnerships with both private and public entities. How do we disseminate important information to our friends in the field? And why are security organizations like the Cyber Threat Alliance so important?

There are so many options now for basic web browsing. There are ad-blocking plugins, privacy browsers, incognito mode, password managers — but for the average user, this can be a lot to keep up with. In this episode of Talos Takes, we dissect all these options and talk about what your best options are to keep your information safe while doing some everyday web browsing.

Honeypots are an important part of threat research and detection. In this episode of Talos Takes, we talk to Christopher Evans, who is our resident honeypot expert at Talos. Chris talks about how he uses them every day, why they’re important to Talos’ overall mission and balancing the use of them with the potential for making attackers smarter.

This week’s episode is actually an excerpt from our recently released roundtable on disinformation and American election security. This is a small part of our larger discussion on fake news, state-sponsored actors using fake social media accounts, and what can be done to combat the spread of disinformation. To see the whole thing, click here.

The dark web sounds scary — and it is. But what exactly does this dark web consist of? Despite what the name may suggest, it’s actually not people selling organs or stolen video games that happened to fall off the back of a truck. But what is actually on these forums? Azim Khodjibaev joins Jon Munshaw this week to discuss his experience with the dark web.

We use the term “APT” in cyber security a lot. But what does it mean, exactly? Does a group have to break a certain threshold to become an APT? Does the term refer to a specific malware family or a group of actors? On this week’s Talos Takes, Jon Munshaw talks to Azim from Talos’ Threat Intelligence team about this very topic.

The value of cryptocurrencies is nowhere near where it was just two years ago. So does that mean cryptominers have gone away as a threat? Jon Munshaw and Nick Biasini sit down in this episode of Talos Takes to discuss where cryptominers stand in 2020. Why aren’t we reading about them as much? And why is being hit with one a sign of worse things to come?

Threat researchers like to throw around the acronym “FUD” a lot. But is FUD, exactly? Why should you look out for it? And why do attackers win when they sow FUD? Joe Marshall and Jon Munshaw walk you through fear, uncertainty and doubt and discuss why panic and misinformation play right into attackers’ hands.

We published our findings on a ransomware family known as MedusaLocker last week. On its surface, it’s just like any other ransomware family — steals your stuff, encrypts it, and asks for some money to get it back. But there are some secret tricks hidden beneath the surface, and Edmund Brumaghin is here to talk about them.

Don’t attackers know we need a break right now? Alas, they’re doing everything they can to capitalize on the COVID-19 pandemic. This includes spreading fear, uncertainty and doubt with fake news, malicious advertisements and misleading information. In this Talos Takes episode, former journalist Jon Munshaw and researcher Nick Biasini discuss best practices for fact-checking, avoiding fake news and intaking the correct information during this trying time.

Yes, adversaries are always looking for new ways to make money. But what’s their No. 2 priority? Information. In this episode of Talos Takes, Nick Biasini and Earl Carter break down the basics of information-stealers and why they’re so important to keep out.

Talos Takes is finally back with its own feed and a new episode. Nick Biasini and Earl Carter discuss the best password practices. Should you use a password manager? What are some best practices? And what does all of this have to do with Disney Plus?

2019 was a huge year for ransomware. Cities across the U.S. had their government services attacked, and adversaries changed up their techniques in the hopes of making a larger profit and infecting more users. What other changes do we see coming to the ransomware space? Are adversaries’ motivations changing at all? And will defense techniques change along with them?

The holidays have come and gone, and so have the sales. Maybe you got a new drone, or a home AI assistant. So what should you do to make sure those new toys don’t turn against you? Nick Biasini and Earl Carter have some tips for you.

We first brought you this episode in the Beers with Talos feedback in December. We’re uploading this to the Talos Takes feed for posterity now, and let’s face it, these holiday shopping reminders can apply to any time you’re shopping online.

This week’s episode of Talos Takes is a special extra large edition. We’ve got the audio version of our recent Cisco Talos Incident Response On Air stream where some of our responders got together to discuss the past threats of the top quarter. Liz Waddell and other team members covered everything from recent ransomware actor drama, to the importance of saving logs and other tips they picked up over the past few months.

Nate Pors joins the show this week to recap the recently released Cisco Talos Incident Response Quarterly Report. He and Jon recap the top attacker trends from the past quarter, including highlighting which types of attacks CTIR saw in the field and what new techniques adversaries are using. Topics discussed include the increased targeting of telecommunications companies, a decline in ransomware attacks and more business email compromise.

Chris Neal from Talos Outreach recently dove into a recent AvosLocker ransomware attack in the wild. This week, he joins the show to recap his major takeaways from this attack that other potential targets can learn from. He and Jon talk about the current ransomware-as-a-service landscape, the use of living-off-the-land binaries and other calling cards from this actor to keep an eye out for.

Jon reports live from the floor of Cisco Live U.S. this week. He interviewed several Talos speakers about their talks at Cisco Live and some of the major takeaways from conversations with users and customers this week.