This week Taylor Wilkes-Pierce, Tim Helming, and Kelsey LaBelle discuss the Pipedream malware toolkit along with the recent seizure of the RaidForums website.

118. Don’t Let Ransomware You Down

This week on Breaking Badness we've got a Special Report. We're talking to Champ Clark III and Steven Drenning-Blalock from Quadrant Security about a re-emergence of the Black Basta ransomware group. Plus—we’ll get their Gold, Guidance and Grievances.

Special Report - Quadrant Security

Kali Fencl, Daniel Schwalbe, and Tim Helming discuss Brian Krebs’ article on namespace collisions and the risks associated with new generic TLDs (gTLDs) along with facial recognition and privacy concerns at major sporting events

192. TLD-fense

In this special Black Hat edition of Breaking Badness, Part 2 of a 5 Part Series, we dive deep into the world of vulnerability management, cyber resilience, and supply chain security. 

Our expert guests—Jacob Graves, Director of Solution Architecture at Gutsy, Theresa Lanowitz, Chief Evangelist at Level Blue, Pukar Hamal, CEO at SecurityPal, and Vinay Anand, Chief Product Officer at NetSPI discuss the increasing complexity of managing vulnerabilities, the critical importance of reducing mean time to detect (MTTD) and mean time to repair (MTTR),
and the emerging strategies for securing the supply chain against growing risks. 

Learn how vulnerability management isn’t just a technical challenge but an organizational one, and explore the nuanced roles of the CIO, CTO, and CISO in maintaining a resilient cyber infrastructure.

Achieving Cyber Resilience through Vulnerability Management and Supply Chain Security

In this episode of Breaking Badness, we dive deep into the evolving world of Endpoint Detection and Response (EDR) and its critical role in modern cybersecurity. 

With threats advancing and the sheer volume of endpoint data skyrocketing, AI and deep learning are becoming game
changers in threat detection and prevention. 

Join us as Carl Froggett, CIO at Deep Instinct, and Melissa Bischoping, Senior Director of Security at Tanium, discuss the past, present, and future of EDR, the impact of AI on cybersecurity, and how SOC teams are evolving to stay ahead of bad actors. 

Learn about how generative AI is influencing attacks, the challenge of SOC burnout, and the innovations shaping the future of endpoint security.

The Future of Endpoint Security: AI, EDR, and SOC Evolution

In this episode of the Breaking Badness Cybersecurity Podcast, Jason Haddix dives into his unique journey from red teaming and pentesting to leading security teams as a CISO in high-profile organizations, including a top gaming company. 

Jason unpacks the distinct challenges of securing a gaming company, where risks come not only from state actors but also from clout-seeking young hackers. He shares valuable insights on building scalable security programs, secrets management, and the importance of radical transparency in corporate security cultures. 

Tune in to hear why, in Jason's words, "gaming saved me from a misspent youth," and learn about his latest ventures into offensive security training and AI-driven security solutions.

Jason Haddix on Red Team Tactics, CISO Challenges, and the Battle for Gaming Security

In this special episode of Breaking Badness, we wrap up 2024 with a countdown of the top episodes, puns, and cybersecurity moments that defined the year. From the hoodiest hacks to the goodiest wins, Kali, Tim, and Taylor reflect on critical insights, industry-changing events, and listener favorites. 

Tune in for discussions about evolving OT security, DNS mishaps, ransomware trends, and expert predictions for 2025. Featuring special moments like our Hacker Summer Camp interviews and top cybersecurity guests, this episode is both insightful and entertaining.

Top Cyber Moments of 2024: Hoodies, Goodies, and Hilarious Puns

Welcome to this special episode of the Breaking Badness Cybersecurity Podcast! We’re turning the spotlight on the books that have shaped the world of cybersecurity and inspired professionals in the field. As part of our ongoing book club series, this episode is a journey into storytelling, research, and the unique perspectives that make cybersecurity literature so compelling. From Ransomware Diaries to the geopolitics of cyber warfare, this discussion is packed with insights and actionable takeaways for anyone working in Infosec.

Cybersecurity Tales: Espionage, Ransomware, and the Stories Behind the Threats

In this episode of Breaking Badness, we dive into the cybersecurity headlines making waves in 2025. We discuss the U.S. Treasury breach, allegedly orchestrated by Chinese hackers using third-party access. Learn about how lingering chat histories can expose sensitive data and the importance of digital spring cleaning.

Spring Cleaning Your Digital Life: APT Threats, Third-Party Breaches, and Chat Risks

In this episode of Breaking Badness, Tricia Howard of Akamai joins Kali Fencl and Ian Campbell to dive deep into the intersection of gaming culture, mental health, and cybersecurity. Tricia shares her journey from theater arts to cybersecurity research, her love for gaming, and her experiences tackling emotional toxicity in digital spaces. 

The episode covers the concept of "mind patches," the role of community in digital wellness, and how gaming and workspaces mirror each other in their challenges with mental health and collaboration. Tune in to hear her thoughts on reducing stigma, creating safe digital spaces, and embracing vulnerability for a healthier cybersecurity community.

Leveling Up Mental Health: Tackling Gaming Toxicity and Cybersecurity Burnout

In this episode of Breaking Badness, we analyze two fascinating cybersecurity incidents that expose both corporate misconfigurations and hacker missteps. 

Security researcher Philippe Caturegli discovered a typo in MasterCard’s DNS records, which left the company open to traffic hijacking and data exposure. This long-overlooked flaw, dating back years, could have been exploited by attackers to redirect users, intercept data, and manipulate services. 

The Script Kiddie Trap: In a turn of events that underscores the “no honor among thieves” trope, a threat actor baited low-skilled hackers (script kiddies) with a fake malware builder. Instead of gaining hacking capabilities, they unwittingly installed a backdoor on their own machines, allowing the original attacker to steal their data and take control of their systems.

DNS Errors and Malware Builders Turning on Attackers

In this episode of Breaking Badness, we welcome back Tanya Janca, aka SheHacksPurple, to discuss her latest book, Alice and Bob Learn Secure Coding. Tanya dives deep into the fundamental principles of secure software development, the psychology behind developer incentives, and the often-overlooked importance of zero trust security.

Zero Trust, Secure Coding & Developer Incentives: Tanya Janca on AppSec’s Biggest Challenges

In this episode of Breaking Badness, we dive into two major cybersecurity concerns: the risks of abandoned S3 buckets and a wave of phishing attacks impersonating DeepSeek. Watchtowr Labs uncovers how forgotten AWS storage can be hijacked for malicious purposes, potentially compromising military, government, and enterprise systems. Meanwhile, attackers exploit DeepSeek’s rising popularity to create lookalike sites, tricking unsuspecting users into downloading malware or exposing credentials. 

Join hosts Kali Fencl, Tim Helming, and Taylor Wilkes-Pierce as they break down these findings with humor, deep insights, and even a few pop culture references. Plus, we rate the severity of these threats on our infamous Hoodie Scale and wrap up with Gold, Guidance & Grievances.

Takeovers, DeepSeek Deceptions & the Cloud’s Dirty Laundry

In this episode of Breaking Badness, we sit down with Bruce and Heidi Potter, two of the masterminds behind ShmooCon, the legendary cybersecurity conference that ran for 20 years. They take us behind the scenes, from its hilarious bar-napkin origins to how they built a tight-knit hacker community that thrived for two decades. 

Building a Hacker Conference from Scratch: The Wild Origins of ShmooCon

Episode 202 of Breaking Badness takes a deep dive into two of the biggest cybersecurity stories of the year (so far):

● Black Basta’s Leaked Chats – A major data leak has exposed internal conversations from this notorious ransomware gang, revealing their internal struggles, ransom negotiations, and even workplace drama.

● Salt Typhoon’s Cyber Espionage – A sophisticated Chinese threat group has been caught infiltrating major U.S. telecommunications providers, raising serious concerns about national security.

Hacked Chats & Telecom Takedowns: Black Basta & Salt Typhoon

In this episode of Breaking Badness, we dive into two major cybersecurity stories: the exploitation of a VPN vulnerability by Chinese APT 41 and the newly discovered “Wall Bleed” flaw in the Great Firewall of China.

APT 41 has been using a critical VPN vulnerability to infiltrate operational technology (OT) organizations, targeting industries like aerospace and defense. Meanwhile, researchers have uncovered a flaw in China's DNS injection system, which inadvertently leaks internal data—an ironic twist for a government known for its strict internet censorship.

Join us as we break down these exploits, their impact on cybersecurity, and what they reveal about modern cyber espionage. We also discuss best practices for securing VPNs, firewall vulnerabilities, and the ethical implications of studying censorship technologies.

APT 41’s VPN Exploits & The Great Firewall’s Leaky Secrets

In this episode of Breaking Badness, host Kali Fencl welcomes Wes Young of CSIRT Gadgets and Daniel Schwalbe, CISO and head of investigations at DomainTools, dive into a recent DomainTools Investigations (DTI) analysis involving ValleyRAT and Silver Fox, and how new tools are enabling faster, more accessible analysis for junior and seasoned analysts alike. Whether you're a threat intel veteran or an aspiring analyst, this episode is packed with hard-earned lessons, technical insights, and future-forward thinking.

They also unpack the evolution of threat intelligence from early higher-ed days of wiki-scraped snort rules to today’s graph-powered AI analysis. Wes shares the origin story behind his platform AlphaHunt, how it's being used to automate and enhance threat detection, and why community sharing remains essential even in an era of advanced tooling.

From ValleyRAT to Silver Fox: How Graph-Based Threat Intel is Changing the Game

In this special DNS Masterclass episode of Breaking Badness, hosts Kali Fencl, Tim Helming, and Taylor Wilkes-Pierce take a deep dive into the Domain Name System often dubbed the backbone and battleground of the internet. From its humble beginnings with host files to its critical role in modern security, the episode unpacks DNS’s evolution, vulnerabilities, and impact on InfoSec.

DNS Masterclass: Attacks, Defenses, and the Day the Internet Was Saved

In this episode of Breaking Badness, host Kali Fencl is joined by DomainTools' Daniel Schwabe
and disinformation expert Scot Terban to uncover how modern Russian disinformation
campaigns are using domain registrars, homoglyph attacks, and generative AI to mimic
legitimate news outlets and manipulate public perception. From the eerie sophistication of
Doppelganger operations to the exploitation of domain infrastructure, this episode sheds light on how truth is being weaponized in the digital era.

We also explore how AI is accelerating the speed and scale of these attacks, and the limited
levers defenders have to push back.

How Russian Disinformation Campaigns Exploit Domain Registrars and AI

In Part 1 of this special two-part panel, the Breaking Badness podcast gathers leading
cybersecurity experts to explore the foundations of DFIR - Digital Forensics and Incident
Response. Featuring Daniel Schwalbe (DomainTools), Lesley Carhart (Dragos), David Bianco
(Splunk), and Sarah Sabotka (Proofpoint), the panel dives into what makes an effective incident
response program, why preparation is often overlooked, and how to bring technical and human
elements together during high-stakes security events.

DFIRside Chat: Lessons from the Frontlines of Incident Response

In this powerful continuation of our DFIR series, cybersecurity experts Daniel Schwalbe, David
Bianco, Lesley Carhart, and Sarah Sabotka dissect the heart of effective incident response,
containment, eradication, recovery, and lessons learned. Packed with firsthand war stories,
sharp tactical advice, and honest debates, this episode is a must-listen for anyone building or
refining their digital forensics and incident response capabilities. Tune in to learn why planning
matters, what to do (and not do) during a breach, and how to make the adversary's job harder,
one containment plan at a time.

DFIR Foundations: Real-World Lessons in Containment, Eradication, and Recovery

In this episode of Breaking Badness, the crew investigates two escalating threats in the cybercrime ecosystem: the cleverly named phishing-as-a-service platform Morphing Meerkat, and the bulletproof hosting provider Proton66, a favorite among amateur cybercriminals.

First, they dig into how Morphing Meerkat uses DNS-over-HTTPS (DoH) and clever phishing kits to evade detection. Then, they shift focus to Proton66, a Russian-based bulletproof host that shelters a new generation of low-skill attackers, including a threat actor known as "Coquettte" with ties to the Horrid Hacking group.

Inside Morphing Meerkat and Proton66: How Cybercrime Is Getting Easier

In this episode of Breaking Badness, we sit down with John Donovan of ZEDEDA to unpack the
lighter and more profound sides of cybersecurity’s biggest gatherings. From RSA’s unexpected
baby goats and vendor booth antics to BSides San Francisco’s community-driven keynote
stage, John shares personal stories, industry insights, and valuable advice on how newcomers
and veterans alike can navigate events like RSA, BSides, and DEF CON. You’ll hear how he
"hacked" his way onto the main stage, what it means to wear a “No Purchasing Authority” pin,
and why protecting your mom from scams might be more urgent than defending your enterprise.

Hacking the Stage: John Donovan on RSAC, BSides SF, and the Human Side of Cybersecurity

In this episode of Breaking Badness, Kali Fencl sits down with Mick Baccio, Global Security
Advisor at Splunk and former CISO for Pete Buttigieg’s 2020 presidential campaign. Mick
shares his journey from aspiring Navy nuclear engineer to leading security in some of the
highest-stakes environments, including the White House.

They explore how threat intelligence, storytelling, and mentorship shape the future of
cybersecurity. From his early days in government to his work on the Splunk SURGe team, Mick
opens up about what it takes to build secure systems, stronger teams, and more empathetic
leadership in cybersecurity.

Building Secure Campaigns and Better Humans: A Conversation with Mick Baccio

In this episode of Breaking Badness, we sit down with Raji Vannianathan, a cybersecurity leader at Microsoft driving the charge on AI security and safety. Raji shares her experience leading the team responsible for managing the end-to-end lifecycle of AI vulnerability disclosures, building proactive safety frameworks, and cultivating a global community of AI security researchers.

From developing Microsoft's AI Bug Bar to launching the "Guardians of AI Safety" Discord
community, she brings both vision and practical strategies to a rapidly evolving field.
We discuss the shifting threat landscape as threat actors begin to leverage generative AI, the
critical need for shared language and cross-functional collaboration, and how Microsoft is
thinking about trust, transparency, and incident response in the AI era. If you’re navigating the
challenges of AI risk, vulnerability coordination, or ethical deployment, this is an essential listen.

It Takes a Village to Secure AI

Welcome to a special RSAC 2025 episode of the Breaking Badness Cybersecurity Podcast!

Today, we delve into the critical role of domains in modern cyber attacks. From sophisticated nation-state operations to AI-powered phishing kits and malicious browser extensions, domains are the foundational infrastructure for threat actors. 

Host Kali Fencl is joined by four leading cybersecurity experts Joe Slowik, Robert Duncan, John Fokker and Vivek Ramachandran to
break down how domains are weaponized and what organizations can do to defend themselves on this ever-evolving frontline

Beyond the Perimeter: How Attackers Use Domains, Phishing & AI and How to Fight Back

In this RSA Conference 2025 special episode, we explore two critical frontiers shaping the
future of cybersecurity.

First, Jon DiMaggio (Author of The Ransomware Diaries, Analyst1) breaks down the hidden
supply chains behind ransomware gangs, including the economics of affiliate betrayal and the
challenge of accurate attribution. He walks us through his methodology for identifying
ransomware rebrands like BlackCat and RansomHub using evidence-based frameworks
designed to eliminate human bias.

Then we’re joined by Matt Radolec (VP of Incident Response at Varonis), who brings a fresh
perspective on talent development in cybersecurity. Drawing from his keynote "From Gamer to
Leader", Matt argues that gamers possess untapped potential as cybersecurity professionals
and it’s time to design leadership pipelines like quest lines.

From ransomware negotiations on underground forums to using AI-enhanced playbooks and
transforming threat response teams into RPG-style guilds, this episode blends technical insight
with cultural reflection.

Inside Ransomware’s Supply Chain: Attribution, Rebrands, and Affiliate Betrayal

In this RSA Conference 2025 special episode, we dive into the evolving world of cyber
attribution, AI-powered threat tactics, and real-world incident response in AWS and GCP
environments.

Our guests include:
● Tal Darsan and Etay Maor from Cato Networks, discussing stealthy attacker techniques,
AI-powered evasion, and lessons from ransomware groups like Medusa, Play, and
Hunters International.

● Yonaten Khen from Hunters, who walks us through how his team discovered a privilege
escalation vulnerability in Google Workspace and what it reveals about modern cloud
attacks.

Zero-Knowledge Threats, Shadow AI, and the Future of Cyber Attribution

Exposing Your Attack Surface on Purpose: API Chaos, AI Risk, and Quantum Reality

76. Hardware...Software....There's a Hack for Everything

Where timely and relevant security meets puns and witty banter. Our goal is to keep defenders apprised of pertinent news and trends in under forty-five minutes.

Breaking Badness

Popular tracks