In this podcast, two students from the University of Groningen talk to each other and an expert about article 6 of the Cybercrime Convention relating to misuse of devices, the clashes between cybercrime regulation and law enforcement, and the taking down of the EMOTET infrastructure.

The Cybercrime Dilemma Podcast RUG

It’s Harrison and Alex this week for your threat intelligence updates. The guys first dig into the NCSC’s recent threat trends report, the first of these that the NCSC has put out. It’s UK-specific, so just like we’ve shared thoughts around the FBI IC3 annual report in the past, which is heavily geared toward the US, it’s good to look across the pond as well. The team digs into 3 main areas: 
- Office365
- Ransomware trends including updates on Emotet, Ryuk, LockerGoga, Bitpaymer, Nemty, and GandCrab
- Supply Chain Attacks

The team also digs into some recent research around B.Wanted. A few weeks ago, there was a story that Brian Krebs reported on: essentially a user on a dark web forum was offering to sell access to a federal contractor who managed 20+ different federal agencies. Specifically we were looking into the threat actor responsible for selling the access, who goes by the name B.Wanted. The guys dig into some different theories.

Finally we round out the episode with some top shows on Netflix to add to your lists. Enjoy your weekends! 

Get the weekly intelligence summary at https://resources.digitalshadows.com/weekly-intelligence-summary

Resources from this week:
NCSC Cyber Threat Trends: https://www.digitalshadows.com/blog-and-research/ncsc-cyber-threat-trends-report-analysis-of-attacks-across-uk-industries/

Nemty Ransomware: https://www.digitalshadows.com/blog-and-research/nemty-ransomware-slow-and-steady-wins-the-race/

Purple Teaming podcast episode with Eliza May Austin: https://dts.podtrac.com/redirect.mp3/podcasts.apple.com/us/podcast/purple-teaming-an-interview-with-eliza-may-austin/id1326304686?i=1000450023564

NCSC Threat Trends And Ransomware Updates

This week host Anna Brading is joined by Sophos experts Mark Stockley, Ben Jones and Peter Mackenzie. 

Ben explains why emotet is back, Peter shares his latest research into WannaCry and Mark shares the latest social media phish. 

Related articles:
Emotet:
https://nakedsecurity.sophos.com/2019/01/25/fighting-emotet-lessons-from-the-front-line/
WannaCry:
https://nakedsecurity.sophos.com/2019/09/18/wannacry-the-worm-that-just-wont-die/
https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/WannaCry-Aftershock.pdf
Instagram phish:
https://nakedsecurity.sophos.com/2019/09/24/instagram-phish-poses-as-copyright-infringement-warning-dont-click/

Naked Security Podcast 

S2 Ep10 – Emotet’s back, mutant WannaCry and Insta scam

Viktoria hosts this week’s episode in London with Phillip Doherty and Adam Cook. After a quick debate around the top trending sports at the moment, the team digs into the first story of the week: Tortoiseshell Group (a newly identified threat group) has reportedly conducted some supply chain attack campaigns against 11 IT providers in Saudi Arabia.
 
Next they look at two new malware variants that have emerged, attributed to North Korean-associated Lazarus Group. Emotet botnet has been hot in the news lately, so the team also talks about its emergence. 
 
Finally the team rounds up the week with the Tyurin indictment, where Andrei Tyurin pleaded guilty to one of the largest computer hacking crimes involving US financial institutions, financial services, and news publishers. Our own Richard Gold published a blog mapping the indictment to the MITRE ATT&CK framework - definitely worth a read below.
 
To learn more, check out our weekly intelligence summary report at https://resources.digitalshadows.com/weekly-intelligence-summary.
 
Mapping the Tyurin Indictment to the Mitre ATT&CK™ framework: https://www.digitalshadows.com/blog-and-research/mapping-the-tyurin-indictment-to-the-mitre-attck-framework/

Tortoiseshell Targets IT Providers, The Tyurin Indictment, And Emotet’s Return

We’re back in London this week! Viktoria chats with Adam Cook, Philip Doherty, and Josh Poole on this week’s top stories:

- APT35 Targets Email of US political figures & prominent Iranians 
- Skimming activity by Magecart 4 reveals potential link to Cobalt Group
- Chinese threat group Rancour casts phishing line to South-East Asian government
- Emotet Resurgence 

Resources From This Week: 
Account Takeover Kill Chain 5 Step Analysis: https://www.digitalshadows.com/blog-and-research/the-account-takeover-kill-chain-a-five-step-analysis/
Weekly Intelligence Summary: https://resources.digitalshadows.com/weekly-intelligence-summary

Make sure to subscribe to us wherever you listen to your podcasts for the latest episodes. Thanks for listening!
- ShadowTalk team

Iran-Linked APT35, Skimming By Magecart 4, Rancour, And Emotet Resurgence

This week’s ShadowTalk hosts Adam, Demi, Stefano and Kim discuss the latest threat intelligence stories. In this episode they cover:
-Trickbot trojan mishap causes wide-spread warnings, alerting users of threatening activity
-Dangerous malware Emotet resurges and partners with Trickbot to infect a large number or users
-Twitter takeover updates - what we know so far
-NCSC advisory about APT29 targeting Covid-19 vaccine research 
-APT35 footage surfaces, exposing the group’s information

Get this week’s intelligence summary at https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-24-july-2020

***Resources from this week's podcast***

NCSC: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development 
Twitter Updates: https://www.bleepingcomputer.com/news/security/coinbase-blocked-twitter-hackers-from-stealing-an-extra-280k/ 
Emotet: https://www.bleepingcomputer.com/news/security/emotet-trickbot-malware-duo-is-back-infecting-windows-machines/
APT35: https://www.wired.com/story/iran-apt35-hacking-video/

Weekly: Trickbot trojan mishaps, Emotet resurgence, Twitter takeovers, and APT group updates

ShadowTalk hosts Viktoria, Adam, Dylan, and Stefano bring you the latest in threat intel. In this week’s episode they cover:
- The ever-popular Emotet - does this dangerous malware have a vaccine? Adam and the team discuss how researchers found a cure.
- What is the Drovorub malware and what is it trying to achieve?
- Takeaways from the U.S. Army’s report on North Korean tactics - what do we know about North Korea’s cyber activity and Bureau 121?

Get this week’s intelligence summary at https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-21-august-2020

***Resources from this week’s podcast***

Emotet: https://www.binarydefense.com/emocrash-exploiting-a-vulnerability-in-emotet-malware-for-defense/

Drovorub: https://www.fbi.gov/news/pressrel/press-releases/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecurity-advisory

Bureau 121: https://www.documentcloud.org/documents/7038686-US-Army-report-on-North-Korean-military.html

Optiv CTIE Report: https://resources.digitalshadows.com/digitalshadows/optivctiereport2020

Weekly: Emotet Gets a Vaccine, NSA Drovorub Advisory, and North Korean Activity plus Bureau 121

This week’s host Kacey is joined by Charles and Alec to bring you the latest in threat intelligence. In this episode they cover: 
- Visa issues a warning about new credit card skimmer “Baka”
- Epic Manchego - Atypical malicious document delivery
- What is Smaug and how does it operate?
- Emotet - are there new developments and why did France send an advisory?

Get this week’s intelligence summary at https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-11-september-2020 

***Resources from this week’s podcast***

Baka: https://www.bleepingcomputer.com/news/security/visa-warns-of-new-baka-credit-card-javascript-skimmer/

Epic Manchego: https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/

Smaug: https://labs.sentinelone.com/multi-platform-smaug-raas-aims-to-see-off-competitors/

France warns of Emotet: https://www.bleepingcomputer.com/news/security/france-warns-of-emotet-attacking-companies-administration/ 

Similar Advisories from Japan & NZ: https://www.zdnet.com/article/france-japan-new-zealand-warn-of-sudden-spike-in-emotet-attacks/

Cyber Espionage Blog: https://www.digitalshadows.com/blog-and-research/cyber-espionage-how-to-not-get-spooked-by-nation-state-actors/

Not Another Ransomware Blog: https://www.digitalshadows.com/blog-and-research/not-another-ransomware-blog-initial-access-brokers-and-their-role/

Weekly: The Team Talks Baka, Epic Manchego, and Smaug, Plus Emotet Rides Again

ShadowTalk hosts Alec, Charles, Austin, and Digital Shadows CISO Rick bring you the latest in threat intelligence. This week they cover:
- Mimecast confirms SolarWinds attackers breached security certificate the latest updates
- The rise and fall of Emotet plus unique video footage of the takedown
- NetWalker ransomware targeted and taken down by US and Bulgarian Law Enforcement 
- Avaddon adopts a new tactic - could it become the MO of other threat groups?
- North Korean threat actors go phishing for security researchers with fake social media profiles

Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-29-january 

***Resources from this week’s podcast***

Mimecast SolarWinds Update: https://www.mimecast.com/blog/important-security-update/ 

23 Sunburst Targets Identified: https://www.netresec.com/?page=Blog&month=2021-01&post=Twenty-three-SUNBURST-Targets-Identified 

Emotet: https://www.zdnet.com/article/emotet-worlds-most-dangerous-malware-botnet-disrupted-by-international-police-operation/ 

Emotet Takedown Video: https://youtu.be/_BLOmClsSpc 

NetWalker: https://www.zdnet.com/article/us-and-bulgarian-authorities-dirsupt-netwalker-ransomware-operation/ 

Avaddon: https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/ 

NK Activity: https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-targeting-security-researchers-with-malware-0-days/ 

Ransomware 2020 Blog: https://www.digitalshadows.com/blog-and-research/ransomware-analyzing-the-data-from-2020/

Also, don’t forget to reach out to - shadowtalk@digitalshadows.com

Weekly: Law Enforcement Wins the Week - The Fall of NetWalker and Emotet!

ShadowTalk hosts Stefano, Adam, and Kim bring you the latest in threat intelligence. This week they cover:
- More threat actors and attack vectors are being investigated in the SolarWinds compromise
- Law enforcement officials in the Netherlands are delivering an Emotet update that will remove it from infected devices
- Kim talks Lebanese Cedar - What’s new in their latest attack?
- Adam reviews Nefilim ransomware - how were they able to gain access and why it reinforces the need for securing employee accounts 
- Plus, don’t miss the malware name of the week! 

Get this week’s intelligence summary at: https://resources.digitalshadows.com/digitalshadows/weekly-intelligence-summary-05-february 

***Resources from this week’s podcast***

SolarWinds Update: https://www.wsj.com/articles/suspected-russian-hack-extends-far-beyond-solarwinds-software-investigators-say-11611921601 

Lebanese Cedar: https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf 

Nefilim Ghost Credentials: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ 

Zinc Attacks: https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/ 

Emotet Disruption: https://www.digitalshadows.com/blog-and-research/emotet-disruption/ 

DarkMarket Seizure: https://www.digitalshadows.com/blog-and-research/darkmarkets-seizure/ 

Also, don’t forget to reach out to - shadowtalk@digitalshadows.com

Weekly: Lebanese Cedar, Nefilim Ghost Credentials, and More on SolarWinds and Emotet

Digital Shadows' ShadowTalk discusses the latest threat intelligence and cybersecurity news with our panel of threat intelligence experts, security engineers, security researchers, and more.

We take an expert look at the latest cybersecurity incidents, how they happened, and why. Tune in weekly to learn what you can do to stop bad things from happening to you!

Popular tracks tagged #emotet