BB host Tim Helming was at the Mandiant Cyber Defense Summit recently, and caught up with two analysts, Regina Elwell and Alyssa Rahman. They describe their roles, how they got into infosec, and what they're researching at the moment.

[Bonus Episode] Voices from Infosec On the Road: Regina Elwell and Alyssa Rahman

104. The Old Bait and Glitch

111. Neither Hide nor Malware

115. A Ransomware for the Dramatic

116. A Breach? I’m Afraid SSO

This week Taylor Wilkes-Pierce, Tim Helming, and Kelsey LaBelle discuss the Pipedream malware toolkit along with the recent seizure of the RaidForums website.

118. Don’t Let Ransomware You Down

Episode 131 of Breaking Badness is now available. This week Taylor Wilkes-Pierce returns! He, Tim Helming, and Kali Fencl discuss AT&T Alien Labs' research on Shikitega malware along with Apple’s rollout of passkeys.

131. XMRing A Ding Ding

Episode 138 of Breaking Badness, Kelsey LaBelle, Tim Helming, and special guest Aaron Gee-Clough discuss SocGholish JavaScript malware along with Phylum’s research regarding PyPI packages in ongoing supply chain attacks.

138. Into The W4SP's Nest

This week Kelsey LaBelle, Tim Helming, and Taylor Wilkes-Pierce discuss vulnerabilities in Siemens programmable logic controllers along with Kevin Chung’s blog post on resurrecting the defunct IoT NYCTrainSign.

145. Me, Myself, and API

This week on Breaking Badness we've got a Special Report. We're talking to Champ Clark III and Steven Drenning-Blalock from Quadrant Security about a re-emergence of the Black Basta ransomware group. Plus—we’ll get their Gold, Guidance and Grievances.

Special Report - Quadrant Security

Oooh it’s the last episode of Breaking Badness before the big 150! This week Kelsey LaBelle, Daniel Schwalbe, and Taylor Wilkes-Pierce discuss the rise of phishing as a service along with a discussion on how mental health data is obtained via third parties.

149. You Data Broker My Heart

The 150th celebration of Breaking Badness continues this week for Part II! We’re talking to Daniel Schwalbe, Sean McNee, Aaron Gee-Clough, and Kelly Molloy about their paths to infosec favorite pod memories, and interests outside of work.

150. Thrifty, Nifty, Never Shifty (Part II)

This week on Breaking Badness, Kelsey LaBelle, Daniel Schwalbe, and Tim Helming discuss the recent collapse of Silicon Valley Bank. We’ll dive into what we’ve been seeing on our end, predictions on what we may see from bad actors, and practical advice for moving forward.

151. Epic Bail: The Collapse of Silicon Valley Bank Its Impact on Infosec

This week Kelsey LaBelle, Tim Helming, and Taylor Wilkes-Pierce discuss Cisco Talos’ Ukraine task unit one year into the Ukraine/Russia conflict along with the Google Pixel and Windows 11 uncropping bugs

152. Good Will Threat Hunting

This week Kelsey LaBelle, Tim Helming, and Aaron Gee-Clough discuss the 5 pillars of the White House’s National Cybersecurity Strategy.

153. It’s Pillar Time!

In this episode for the Stronger Together Mini-Series, we are joined by Allan Liska, Ransomware Researcher at Recorded Future. We sat down (or rather, stood and leaned against a wall away from noise) to discuss his path to infosec, interesting talks at RSA, liberal arts and cybersecurity, a pending passion project, and general geeking out over DNS.

[Mini Series] Stronger Together with Allan Liska

We’ve made it to the third installment of our Stronger Together Mini Series! In this episode we’re joined by researchers, threat analysts, and C-Suites including Katie Nickels from Red Canary and the SANS Institute, Don Jeter from Torq, Ben April from Maltego, Lesley Carhart from Dragos, and Jeff Stout from Akamai. We have some great discussions on the pros and cons of AI, protecting industrial control systems, imposter syndrome, and more.

[Mini Series] Stronger Together: Katie Nickels, Don Jeter, Ben April, Lesley Carhart & Jeff Stout

We've made it to the final installment of our Stronger Together Mini-Series! In this episode, you'll hear from folks at DomainTools including CEO Tim Chen, veteran podcaster Daniel Schwalbe, and more!

[Mini Series] Stronger Together: Tim Chen, Daniel Schwalbe, and Your Friends at DomainTools

This week Kelsey LaBelle, Kelly Molloy, and Taylor Wilkes-Pierce discuss a pandemic catfishing scam along with Eclypsium’s detection of backdoor behavior from Gigabyte systems.

156. Romancing the Scam

This week Tim Helming, Sean McNee, and guest researcher Sasha Angus discuss the most prolific ransomware families and share cybersecurity gold, guidance, and grievances.

157. They Ransomware

In this special Black Hat edition of the Breaking Badness Cybersecurity Podcast, Part 1 of a 5 Part Series, we dive deep
into how artificial intelligence is transforming the cybersecurity landscape. 

Our guests—Mark Wojtasiak (VP of Product at Vectra AI), Carl Froggett (CIO at Deep Instinct), Dan Fernandez
(Staff Product Manager at Chainguard), and Marcus Ludwig (CEO of Ticura)—join us to explore the evolution of Endpoint Detection and Response (EDR), the growing threats posed by generative AI, and the complexities of securing AI in supply chains. With AI becoming a tool for both attackers and defenders, this episode uncovers the ongoing "AI arms race" and highlights the urgent need for a more preventative approach to cybersecurity.

AI’s Role in Cybersecurity: From EDR Evolution to Generative AI Threats and Supply Chain Risks

In this episode of Breaking Badness, we dive into the rapidly evolving world of cybersecurity with three industry leaders: Raymond Dijkxhoorn, CEO of SURBL; Nabil Hannan, Field CISO at
NetSPI; and Jason Mar-Tang, Field CISO at Pentera. They explore the critical role of domain reputation in combating phishing and spam, how AI is reshaping both offensive and defensive
cybersecurity strategies, and the growing threat of ransomware in today’s digital landscape.

With insights from BlackHat and beyond, we discuss everything from the future of phishing defense to the challenges AI poses in securing sensitive data, as well as how ransomware continues to evolve. 

Tune in to gain actionable insights on staying ahead of cyber threats and protecting your digital domain.

Defending Your Digital Domain: AI, Ransomware, and the Power of Reputation

Join Kali Fencl as she dives deep into a conversation with cybersecurity veteran The Gibson. 

With 25+ years in InfoSec, The Gibson shares his journey from coding as a child to shaping threat intelligence and privacy-first technology today. In this episode, they discuss hacker ethics, the influential hacker groups Loft and Cult of the Dead Cow, the evolution of hacktivism, and the groundbreaking work on privacy-focused projects like Veilid. 

Tune in for insights on hacking culture, cybersecurity ethics, and the balance between creativity and responsibility in the digital age.

Inside the Mind of ‘The Gibson’: Ethics, Activism, and the Evolution of Hacking

In this week’s episode of Breaking Badness, we dive deep into two major cybersecurity stories that are shaping today’s landscape. First, we explore the alarming capabilities of Locate X, a powerful smartphone tracking tool used by U.S. law enforcement without a warrant. How does it work, what are the privacy implications, and what can individuals do to protect their data? 

We then shift gears to APT29’s latest campaign as discovered by Amazon, uncovering how this well-known threat actor employed advanced tactics to impersonate AWS infrastructure and
target victims. 

Join Kali Fencl, Tim Helming, and Taylor Wilkes-Pierce as they dissect these stories and share their expert insights. Stick around for the Grim Reaper’s hoodie ratings and our signature segment, Gold, Guidance, and Grievances.

194. Locate X Unleashed & APT29’s Latest Gambit: The Battle for Digital Privacy

Welcome to this special episode of the Breaking Badness Cybersecurity Podcast! We’re turning the spotlight on the books that have shaped the world of cybersecurity and inspired professionals in the field. As part of our ongoing book club series, this episode is a journey into storytelling, research, and the unique perspectives that make cybersecurity literature so compelling. From Ransomware Diaries to the geopolitics of cyber warfare, this discussion is packed with insights and actionable takeaways for anyone working in Infosec.

Cybersecurity Tales: Espionage, Ransomware, and the Stories Behind the Threats

In this powerful continuation of our DFIR series, cybersecurity experts Daniel Schwalbe, David
Bianco, Lesley Carhart, and Sarah Sabotka dissect the heart of effective incident response,
containment, eradication, recovery, and lessons learned. Packed with firsthand war stories,
sharp tactical advice, and honest debates, this episode is a must-listen for anyone building or
refining their digital forensics and incident response capabilities. Tune in to learn why planning
matters, what to do (and not do) during a breach, and how to make the adversary's job harder,
one containment plan at a time.

DFIR Foundations: Real-World Lessons in Containment, Eradication, and Recovery

In this episode of Breaking Badness, the crew investigates two escalating threats in the cybercrime ecosystem: the cleverly named phishing-as-a-service platform Morphing Meerkat, and the bulletproof hosting provider Proton66, a favorite among amateur cybercriminals.

First, they dig into how Morphing Meerkat uses DNS-over-HTTPS (DoH) and clever phishing kits to evade detection. Then, they shift focus to Proton66, a Russian-based bulletproof host that shelters a new generation of low-skill attackers, including a threat actor known as "Coquettte" with ties to the Horrid Hacking group.

Inside Morphing Meerkat and Proton66: How Cybercrime Is Getting Easier

In this episode of Breaking Badness, we sit down with John Donovan of ZEDEDA to unpack the
lighter and more profound sides of cybersecurity’s biggest gatherings. From RSA’s unexpected
baby goats and vendor booth antics to BSides San Francisco’s community-driven keynote
stage, John shares personal stories, industry insights, and valuable advice on how newcomers
and veterans alike can navigate events like RSA, BSides, and DEF CON. You’ll hear how he
"hacked" his way onto the main stage, what it means to wear a “No Purchasing Authority” pin,
and why protecting your mom from scams might be more urgent than defending your enterprise.

Hacking the Stage: John Donovan on RSAC, BSides SF, and the Human Side of Cybersecurity

In this episode of Breaking Badness, Kali Fencl sits down with Mick Baccio, Global Security
Advisor at Splunk and former CISO for Pete Buttigieg’s 2020 presidential campaign. Mick
shares his journey from aspiring Navy nuclear engineer to leading security in some of the
highest-stakes environments, including the White House.

They explore how threat intelligence, storytelling, and mentorship shape the future of
cybersecurity. From his early days in government to his work on the Splunk SURGe team, Mick
opens up about what it takes to build secure systems, stronger teams, and more empathetic
leadership in cybersecurity.

Building Secure Campaigns and Better Humans: A Conversation with Mick Baccio

In this episode of Breaking Badness, we sit down with Raji Vannianathan, a cybersecurity leader at Microsoft driving the charge on AI security and safety. Raji shares her experience leading the team responsible for managing the end-to-end lifecycle of AI vulnerability disclosures, building proactive safety frameworks, and cultivating a global community of AI security researchers.

From developing Microsoft's AI Bug Bar to launching the "Guardians of AI Safety" Discord
community, she brings both vision and practical strategies to a rapidly evolving field.
We discuss the shifting threat landscape as threat actors begin to leverage generative AI, the
critical need for shared language and cross-functional collaboration, and how Microsoft is
thinking about trust, transparency, and incident response in the AI era. If you’re navigating the
challenges of AI risk, vulnerability coordination, or ethical deployment, this is an essential listen.

It Takes a Village to Secure AI

Welcome to a special RSAC 2025 episode of the Breaking Badness Cybersecurity Podcast!

Today, we delve into the critical role of domains in modern cyber attacks. From sophisticated nation-state operations to AI-powered phishing kits and malicious browser extensions, domains are the foundational infrastructure for threat actors. 

Host Kali Fencl is joined by four leading cybersecurity experts Joe Slowik, Robert Duncan, John Fokker and Vivek Ramachandran to
break down how domains are weaponized and what organizations can do to defend themselves on this ever-evolving frontline

Beyond the Perimeter: How Attackers Use Domains, Phishing & AI and How to Fight Back

In this RSA Conference 2025 special episode, we explore two critical frontiers shaping the
future of cybersecurity.

First, Jon DiMaggio (Author of The Ransomware Diaries, Analyst1) breaks down the hidden
supply chains behind ransomware gangs, including the economics of affiliate betrayal and the
challenge of accurate attribution. He walks us through his methodology for identifying
ransomware rebrands like BlackCat and RansomHub using evidence-based frameworks
designed to eliminate human bias.

Then we’re joined by Matt Radolec (VP of Incident Response at Varonis), who brings a fresh
perspective on talent development in cybersecurity. Drawing from his keynote "From Gamer to
Leader", Matt argues that gamers possess untapped potential as cybersecurity professionals
and it’s time to design leadership pipelines like quest lines.

From ransomware negotiations on underground forums to using AI-enhanced playbooks and
transforming threat response teams into RPG-style guilds, this episode blends technical insight
with cultural reflection.

Inside Ransomware’s Supply Chain: Attribution, Rebrands, and Affiliate Betrayal

In this RSA Conference 2025 special episode, we dive into the evolving world of cyber
attribution, AI-powered threat tactics, and real-world incident response in AWS and GCP
environments.

Our guests include:
● Tal Darsan and Etay Maor from Cato Networks, discussing stealthy attacker techniques,
AI-powered evasion, and lessons from ransomware groups like Medusa, Play, and
Hunters International.

● Yonaten Khen from Hunters, who walks us through how his team discovered a privilege
escalation vulnerability in Google Workspace and what it reveals about modern cloud
attacks.

Zero-Knowledge Threats, Shadow AI, and the Future of Cyber Attribution

Exposing Your Attack Surface on Purpose: API Chaos, AI Risk, and Quantum Reality

In this episode of Breaking Badness, Kali Fencl sits down with Audra Streetman, a former journalist turned threat intelligence analyst at Splunk. Audra shares her journey from local newsrooms to the frontlines of cybersecurity, detailing how her storytelling skills translate directly into threat research.

Audra walks us through how ransomware attacks like JBS Foods and the Excellion breach sparked her pivot into cyber. She dives deep into persistent threat tactics, such as file transfer appliance exploitation, the growing risk of cloud infrastructure attacks, and North Korean IT worker scams.

If you're a cybersecurity professional, a curious career switcher, or someone looking to stay ahead of threat actor trends, this episode delivers real insight with practical relevance.

From Newsroom to Threat Room: Audra Streetman’s Journey into Cybersecurity

In this episode, DomainTools' Daniel Schwalbe is joined by Renee Burton (Infoblox), Raymond Dijkxhoorn (Surbl), and Peter Lowe (FIRST.org) to unpack the inaugural DomainTools Intelligence Report and what it reveals about DNS-based threats in 2024. The panel digs into evolving detection challenges, the pitfalls of domain scoring, the growing complexity of threat actor behavior, and why industry collaboration continues to lag.

They explore topics like aging domains, TLD abuse, data sharing barriers, and the creative lengths bad actors go to avoid detection. Whether you're building threat intel tools or blocking domains at the edge, this conversation is a must-listen for anyone in DNS-based security.

Why DNS Is Still the Biggest Blind Spot in Threat Intelligence

Where timely and relevant security meets puns and witty banter. Our goal is to keep defenders apprised of pertinent news and trends in under forty-five minutes.

Breaking Badness

Popular tracks