Microsoft Threat Intelligence Podcast

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Technical Program Manager at Microsoft Lynn Miyashita and Principal Research Manager, Andrew Paverd. They discuss the evolution of bug bounty programs into the realm of artificial intelligence, specifically focusing on Microsoft's initiative launched in October 2023. Lynn explains that the AI Bug Bounty incentivizes external security researchers to discover and report vulnerabilities in Microsoft's AI systems, such as Copilot, across various platforms including web browsers and mobile applications. Andrew elaborates on the concept of a "bug bar," which sets the criteria for vulnerabilities eligible for the program. They emphasize the importance of identifying security issues that could arise uniquely from AI systems, such as prompt injection vulnerabilities. The discussion highlights Microsoft's structured approach to handling reported vulnerabilities through their Security Response Center, emphasizing quick mitigation and coordination with researchers to ensure timely fixes and public disclosure.     In this episode you’ll learn:          How AI Bug Bounty programs are reshaping traditional security practices  Dangers of prompt injection attacks, and their capacity to exfiltrate sensitive data  Why you should engage in AI bug hunting and contribute to the evolving security landscape    Some questions we ask:         Which products are currently included in the Bug Bounty program?  Should traditional bug bounty hunters start doing AI bug bounty hunting?  How can someone get started with AI bug hunting and submitting to your program?      Resources:   View Lynn Miyashita on LinkedIn   View Andrew Paverd on LinkedIn   View Sherrod DeGrippo on LinkedIn     Microsoft AI Bug Bounty Program      Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks          Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider      The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

In this episode of the Microsoft Threat Intelligence Podcast recorded at the RSA Conference in San Francisco, host Sherrod DeGrippo engages with a diverse group of cybersecurity experts. David Weston, VP of Operating System Security at Microsoft, discusses the evolution of Windows security and the role of AI. Jamie Williams from MITRE shares insights on the importance of product functionality in cybersecurity. Emma Stewart, Chief Power Grid Scientist at Idaho National Lab, talks about securing the digital transition of the power grid. Joe Slowik from MITRE emphasizes the importance of threat intelligence and integrating cybercrime entities into their attack framework. Lindsey O'Donnell, executive editor of Decipher, highlights AI's crucial role in cybersecurity and finally, Todd Pauley, deputy CISO of the Texas Education Agency, discusses the challenges faced by small school districts in Texas.    In this episode you’ll learn:          How Windows security has transitioned from user-controlled to Microsoft-managed  The importance of understanding product functionality to combat cyber threats  Securing the power grid's digital transition and cloud technologies for grid control     Some questions we ask:         What challenges and opportunities arise in securing the power grid's digital transition?  How does AI enhance security in Windows operating systems?  What were some of the most memorable sessions you attended at RSA?    Resources:   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider      The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Mark Russinovich.  Mark Russinovich, CTO and Technical Fellow of Microsoft Azure, joins the show to talk about his journey from developing on-prem tools like Sysinternals to working in the cloud with Azure. Sherrod and Mark discuss the evolution of cybersecurity, the role of AI in threat intelligence, and the challenge of jailbreaking AI models. Mark shares his experiences with testing AI models for vulnerabilities, including his discovery of the "Crescendo" and "Masterkey" methods to bypass safety protocols. They also touch on the issue of poisoned training data and its impact on AI reliability, while highlighting the importance of staying ahead in cybersecurity.  In this episode you’ll learn:       The shift from desktop computing to cloud-based systems and its implications  Potential consequences of AI models having overridable safety instructions  How AI training data can manipulate the outcomes generated by AI models  Some questions we ask:      Will AI owners be able to stop data poisoning, or will it become more common?  Can you share challenges and vulnerabilities in maintaining the security of AI systems?  What sparked your interest in AI jailbreaks, and what trends are you seeing?  Resources:   View Mark Russinovich on LinkedIn   View Sherrod DeGrippo on LinkedIn     AI jailbreaks: What they are and how they can be mitigated? https://www.microsoft.com/en-us/security/blog/2024/06/04/ai-jailbreaks-what-they-are-and-how-they-can-be-mitigated/  Inside AI Security with Mark Russinovich | BRK227  https://www.youtube.com/watch?v=f0MDjS9-dNw  How Microsoft discovers and mitigates evolving attacks against AI guardrails. https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails/  Google AI said to put glue on pizza. https://www.businessinsider.com/google-ai-glue-pizza-i-tried-it-2024-5    Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by two of MSTIC’s finest analysts. They discuss recent trends in financially motivated cyber threats observed by Microsoft, focusing particularly on two cases: the Grandoreiro banking Trojan and the Luna Tempest crimeware actor. The Grandoreiro Trojan, active since 2017, has expanded globally beyond its initial Latin American focus, now targeting countries like the U.S. and the UK. This Trojan typically starts with phishing emails to steal financial information. Despite efforts to disrupt this activity, new clusters have emerged. The discussion also covers Luna Tempest, a U.S.- and UK-based extortion group targeting startups and smaller companies, particularly in sectors like insurance, FinTech, and biotech, seeking high payouts by threatening to release sensitive data.    In this episode you’ll learn:       The resilience and adaptability of threat actors in response to global disruption efforts  Why Luna Tempest focuses solely on extortion without deploying ransomware  How the Grandoreiro Banking Trojan has expanded globally     Some questions we ask:      How do we distinguish between the various threat actor groups and their malware?  What can businesses do to protect themselves from identity-based attacks?  Have these cybercriminals perfected an extortion program?    Resources:   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Andrew Morris, Founder & Chief Architect at GreyNoise and Lauren Proehl, Director of Global Cyber Defense at Marsh McLennan. Lauren Proehl is an experienced cybersecurity leader who has helped defend against threat actors in Fortune 500 networks and has managed multiple divisions focused in defensive security and specializes in innovative cyber defense. GreyNoise operates a huge sensor network across the internet that collects primary sourced data on which vulnerabilities attackers are exploiting, when they start, and from where. Sherrod, Lauren, and Andrew discuss the effectiveness of banning ransomware payments, the importance of focusing on backup and disaster recovery strategies, the necessity of investing in basic security measures like endpoint detection and response, multi-factor authentication, and log storage.     In this episode you’ll learn:       The potential for ransomware attacks on physical infrastructure  Why most are hesitant to become a CISO and the expectations that come with the role  Challenges when try to balance technical expertise with leadership skills    Some questions we ask:      Can government or law enforcement agencies evolve in combating ransomware?   Where do you believe organizations can invest to improve their cybersecurity?  How do you expect ransomware to change with tactics like double or triple extortion?    Resources:   View Lauren Proehl on LinkedIn   View Andrew Morris on LinkedIn      View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Thomas Roccia and Andres Freund. Andres stumbled upon a security issue within SSH while investigating performance discrepancies. He discovered a sophisticated backdoor, skillfully concealed within the LZMA library, part of the XZ package. Sherrod, Thomas, and Andres discuss the importance of proactive security measures and code review in the open-source community. They emphasize the critical role of community collaboration in identifying and mitigating security threats effectively and signal the need for heightened vigilance.      In this episode you’ll learn:       The importance of proactive security and code review in the open-source community  Why anomalies in software behavior should prompt curiosity and investigation  Open-source community cooperation is vital for spotting and addressing security risks    Some questions we ask:      Could you explain the security issue you found in SSH and its significance?  How serious is this threat, and what steps can organizations take to defend against it?  What advice do you have for open-source contributors?    Resources:   View Andres Freund on LinkedIn   View Thomas Roccia on LinkedIn      View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by former VP of Cybersecurity Solutions at Target Paul Melson. Sherrod and Paul reflect on his experiences in incident response, highlighting the adrenaline rush of detecting and evicting adversaries before they cause harm. Their discussion includes a run down the rabbit hole of open-source intelligence and the creation of the @scumbots twitter feed. They explore the culture at Target's cybersecurity team, emphasizing the importance of hiring for attitude and the potential for new threats like bribery and insider threats. Paul shares insights into his experiences in cybersecurity and his concerns about future threats, emphasizing the need for continued vigilance and innovation in defense strategies. The episode provides valuable insights into the challenges and developments in cybersecurity, offering practical advice for both professionals and organizations navigating the ever-changing threat landscape.      In this episode you’ll learn:       The genesis of the project scumbots and its functionality  Challenges when dealing with commercial threat intelligence companies   The increasing sophistication of cybercrime and the potential for new tactics     Some questions we ask:      How has your time in incident response evolved over the years?  What advice would you give to aspiring cybersecurity professionals  Do you believe organizations can adapt and innovate their defense strategies?    Resources:   Scumbots on Twitter  View Paul Melson on LinkedIn      View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is Live from Microsoft Secure in San Francisco and is joined by Brandon Dixon and Vasu Jakkal. As Group Product Manager for Security Copilot, Brandon is helping to shape how generative AI is used to empower professionals to focus on what matters most. Brandon reflects on how security practices have changed, mental health in the security industry and how AI can empower individuals in the tech and infosec fields. Vasu discusses her passion for cybersecurity and its impact on global safety. She emphasizes the importance of inclusivity and optimism in tackling security challenges and shares her journey into cybersecurity, which was influenced by her love for technology instilled by watching Star Trek. Vasu also highlights the transformative potential of AI, particularly Microsoft Copilot for Security, in enhancing defense capabilities and catching new threats.     In this episode you’ll learn:       AI enhancing security practices and empowering individuals in the cybersecurity field  The value of sharing ideas for critique, fostering inspiration, and driving innovation  How AI has the power to unveil the wonders of the world while enhancing safety   Some questions we ask:      How will Co-Pilot for Security affect threat intelligence professionals and their work?  What are you using AI for at work, both in terms of security and more generic AI?  Can you share examples of how Copilot helps in your personal life?    Resources:   View Brandon Dixon on LinkedIn   View Vasu Jakkal on LinkedIn     View Sherrod DeGrippo on LinkedIn   Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is Live from Times Square at Microsoft Secure and is joined by Chris Wysopal, Chip Calhoun, and Torrell Funderburk. Chris (aka Weld Pond) reflects on his experiences with L0pht, the evolution of bug bounty programs and their dominance in the cybersecurity space, highlighting both the benefits and drawbacks. Chip explains how Copilot for Security assists with threat hunting and script analysis, enhancing analysts' capabilities in identifying threats and malicious activities. He also touches on the prevalent threat actor profiles, highlighting the prevalence of e-crime and the potential impact of nation-state actors. Terrell expresses excitement about the advancements in their security program and the ability to detect and respond at scale. He also discusses his transition from software engineering to cybersecurity and encourages others to consider the move due to the foundational similarities between the fields.       In this episode you’ll learn:       Complications from vulnerabilities discovered in open-source software  Practical applications of Copilot in incident response and threat intelligence  The importance of curiosity and problem-solving skills when building a security team.     Some questions we ask:       How do you view the role of AI and machine learning in security, and bug bounties?  What do you think is unique about securing critical infrastructure targets?  Will AI influence security practices in organizations and industries going forward?    Resources:   View Chris Wysopal on LinkedIn  View Chip Calhoun on LinkedIn   View Torrell Funderburk on LinkedIn    View Sherrod DeGrippo on LinkedIn   Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks         Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Emily Yale and Anna Bertiger. The discussion delves into Emily and Anna's daily activities within the security domain. Emily highlights her role in supporting Microsoft's internal Security Operations Center by building detections for potential threats. Anna emphasizes the practical application of research in solving security problems and focuses on anomaly detection in post-breach security. Emily and Anna provide insights into Microsoft's work culture, the intersection of technology and security, the importance of mathematical and data science skills in tech roles, and the practical applications of AI tools in professional and personal contexts.    In this episode you’ll learn:       How data scientists support the internal SOC and enhance security  The importance of anomaly detection in post-breach security  Combining security with mathematical skills to create practical solutions     Some questions we ask:         What types of unusual patterns indicate malicious activity?   Is there difficulty in securing AI models compared to traditional code?   Should data science methods be used over complex models?    Resources:   View Emily Yale on LinkedIn   View Anna Bertiger on LinkedIn   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Stella Aghakian and Holly Burmaster. They explore the intrigue of watching threat actors and their techniques and walk through these techniques and how they are educational and critical in threat intelligence work. They also discuss their experiences at Microsoft Ignite, insights into the cyber threat actor Octo Tempest, and personal reflections on threat intelligence and favorite threat actors. Both Stella and Holly discuss how they thrive on the uncertainty and variety of their work despite the long hours and high pressure but appreciate the supportive team environment that helps them.      In this episode you’ll learn:       Challenges of incident response when dealing with destructive threat actors  Difficulty in managing the emotional aspects of incident response  The unpredictability and dynamic nature of incident response work     Some questions we ask:        How is the workflow structured in incident response teams?  What traits are crucial for excelling in the high-pressure world of incident response?  Do Dart and Mystic teams collaborate in incident responses?    Resources:   View Stella Aghakian on LinkedIn   View Holly Burmaster on LinkedIn   View Sherrod DeGrippo on LinkedIn   Octo Tempest Threat Actor profile  Protecting credentials against social engineering    Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Bryan Prior and Nirit Hinkis from the Microsoft Threat Analysis Center. Sherrod, Bryan, and Nirit discuss Iranian influence operations, distinguishing between influence and information operations. The conversation covers examples of cyber-enabled influence operations, focusing on Iran's actions related to the 2020 U.S. presidential elections and the Israel-Hamas war. The discussion covers tactics Iranian actors use, such as impersonation, recruiting locals, and leveraging email and text messages for amplification. The podcast brings context to the intricacies of Iranian cyber activities, their collaborative efforts, propaganda consumption, creative tactics, and challenges in attribution for influence operations.       In this episode you’ll learn:       The collaboration among Iranian groups in cyber-enabled influence operations  Wiper attacks in situations involving both cyber and kinetic operations  Unique aspects of Iran's influence operations     Some questions we ask:      What's the reason behind a spike in Iranian propaganda consumption in Canada?  Where does Iran fall compared to other countries like Russia and North Korea?  What might be coming up regarding Iranian cyber attacks and influence operations?   Resources:   View Bryan Prior on LinkedIn  View Sherrod DeGrippo on LinkedIn   Iran Report   Iran Accelerates Cyber Ops Against Israel  Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Christine Fossaceca, Laurie Kirk, and Apurva Kumar. Today's discussion concerns a recent release from the Chaos Computer Congress, where researchers discovered and analyzed a zero-click attack on iPhones. The attack involves four zero-day vulnerabilities in iOS, requiring a malicious iMessage, a hardware bug, and a Safari exploit. The spyware discovered was specifically targeting security researchers. Sherrod, Christine, Laurie, and Apurva explore the significance of this attack, its implications for mobile security, the concept of zero-click attacks becoming more prevalent on mobile devices, and the importance of researchers being vigilant about their security.       In this episode you’ll learn:       Why you should consider the threat landscape when traveling internationally  The technical and strategic aspects of mobile threat intelligence  Prevalence of spyware on both Android and iOS platforms     Some questions we ask:      How can attackers disguise Trojans to harvest personal details?  What are the communication vehicles that you're seeing phishing come from?  How do I know if I have malware on my phone?     Resources:   Follow Christine on Twitter @x71n3 & @herhaxpodcast   View Laurie Kirk on LinkedIn   View Apurva Kumar on LinkedIn   View Sherrod DeGrippo on LinkedIn   DEV-0196: QuaDream’s “KingsPawn” malware targets Europe, North America, the Middle East, and Southeast Asia | Microsoft Security Blog  37C3 - Operation Triangulation: What You Get When Attack iPhones of Researchers    Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Greg Schloemer and Matthew Kennedy. Sherrod, Greg, and Matthew discuss North Korean cyber operations, highlighting the unique aspects that set North Korea apart, emphasizing North Korea's persistence, adaptability, and the blending of APT and cybercrime elements, mainly focusing on revenue generation through activities like cryptocurrency theft. The discussion touches on the notorious Lazarus group, known for the Sony Pictures attack and WannaCry, and how their actions captured global attention. Sherrod, Greg, and Matthew also share personal insight into why they're drawn to this particular area of cybersecurity, offering listeners a unique perspective on the motivations and passions driving those at the forefront of defending our digital world.      In this episode you’ll learn:       The evolution of North Korean cyber operations  How cryptocurrency theft is used as a means to support the state   North Korea's unique approach to cyber operations and strategic evolution over time     Some questions we ask:      How much work have you put into becoming a blockchain and cryptocurrency expert?  What challenges arise in defending against these specific software supply chain attacks?  Why are you interested in working on North Korea-related cybersecurity?    Resources:   View Greg Schloemer on LinkedIn   View Matthew Kennedy on LinkedIn    View Sherrod DeGrippo on LinkedIn   Diamond Sleet supply chain compromise distributes a modified CyberLink installer     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Jeremy Dallman, Kimberly Ortiz, and Steve Ginty. Sherrod emphasizes the importance of understanding vulnerabilities before they're exploited in the wild and discusses the process of responding to security vulnerabilities, including identifying threat actors and the urgency of patch deployment, especially for vulnerabilities targeted by ransomware groups. The conversation also focuses on Security Copilot, a tool built on Microsoft's extensive threat intelligence, designed to make SOC analysts' work more accessible by providing immediate, relevant information on threats. This episode offers an insider's view on how these professionals track internal incident responses, share crucial intelligence with customers, and continuously evolve their processes to ensure swift, accurate delivery of threat intelligence.       In this episode you’ll learn:       -How collaborating with multiple MS teams enhances intel delivery   -Interaction between Microsoft Defender Threat Intelligence and Security Copilot  -Publishing actor profiles based on internal observations of techniques and procedures     Some questions we ask:       -How will the world of AI affect the role of threat intelligence?   -What are you most excited about when it comes to AI in cybersecurity?   -When do we share intel with customers, and has that process changed over the years?  Resources:   View Kimberly Ortiz on LinkedIn   View Steve Ginty on LinkedIn   View Jeremy Dallman on LinkedIn   View Sherrod DeGrippo on LinkedIn     MDTI: Now Anyone Can Tap Into Game-Changing Threat Intelligence  The Future of Security with AI  A Year in Intel: Highlights from Microsoft's Global Stand Against APTs  The risk of trust: Social engineering threats and cyber defense  Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks    Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Judy Ng, Mark Parsons, and Ned Moran. Together, they delve into the riveting world of Cyberwarcon, exploring the activities of threat actors such as Volt Typhoon from China and Iranian-based adversaries. Sherrod sheds light on Volt Typhoon's strategic targeting of critical infrastructure while the team elaborates on the Iranian actors' reactive and opportunistic approach to current cyber attacks. The episode unfolds with insightful discussions of sophisticated techniques like "living off the land" and the intricacies of information operations while providing a deep dive into the evolving landscape of cyber threats and intelligence.       In this episode you’ll learn:       The use of AI in the current world of cybersecurity  Why North Korean cyber activity is often referred to as Lazarus  Unique challenges and motivations for tracking APT groups      Some questions we ask:      What are some challenges when following chaotic and unpredictable threat actors?  How do you balance secondary projects like incident response and ransomware?  What motivates someone to pursue a career in APT tracking and analysis?    Resources:   View Mark Parsons on LinkedIn  View Ned Moran on LinkedIn  View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft Threat Research and Intelligence Leader Wes Drone. Wes has spent five years investigating criminal and national security computer intrusions for the FBI Cyber Division. After the FBI, he helped a Fortune 25 healthcare organization mature its security operations while gaining first-hand experience in risk management. Sherrod and Wes discuss his current role at Microsoft, where he focuses on messaging and web research. They also touch on the evolving landscape of phishing attacks and the impact of ChatGPT on code writing and security.    In this episode you’ll learn:       How ChatGPT has improved code and empowered security to create better code  Why phishing attacks have evolved with new techniques and capabilities   The preferences of threat actors and their willingness to adapt     Some questions we ask:      How have ransomware attacks shifted to a broader issue for entire businesses?  Why should defenders be constantly adapting to new tactics from threat actors?  What challenges and strategies have you noticed from the existing threat landscape?    Resources:   View Wes Drone on LinkedIn  View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Jack Mott to discuss the movie "Heat" and its relevance to social engineering and threat actor psychology. They also chat about the challenges of identifying real threats in the world of information security, highlighting the need for vigilance in detecting both evident and subtle threats. The conversation revolves around the complexities of distinguishing between genuine and malicious activity and the importance of a nuanced approach to cybersecurity.      In this episode you’ll learn:       Why experimentation and new approaches in the security industry are so necessary  Microsoft's approach to handling and investigating blocked threats  The importance of an adaptive system to stay updated on evolving threats and behaviors     Some questions we ask:      Why is curiosity a crucial quality for success in the information security field?  How do you deal with making mistakes and taking risks in your work?  Why do you foster relationships and share information with other professionals?    Resources:   View Sherrod DeGrippo on LinkedIn   Microsoft Ignite Panel, The risk of trust: Social engineering threats and cyber defense       Related Microsoft Podcasts:                     Afternoon Cyber Tea with Ann Johnson   The BlueHat Podcast   Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft threat research experts to talk about the activities of a threat actor known as Octo Tempest (which overlaps with research associated with 0ktapus, Scattered Spider, and UNC3944) and the blog released by Microsoft threat intelligence and Microsoft incident response groups. The discussion covers various tactics, techniques, and procedures Octo Tempest employs, such as SIM swapping, SMS phishing, and living off the land rather than using traditional malware. Octo Tempest is portrayed as a highly bespoke and hands-on threat actor, often engaged in "keyboard-to-keyboard combat" and showing extreme persistence even after being detected.      In this episode you’ll learn:       Techniques used to modify email rules and evade defensive tools  The contrast between tailored attacks and automated targeted threat actors   Why organizations should separate high-privileged accounts from normal user accounts     Some questions we ask:      Is there an end game for OctoTempest, and is it always ransomware?  What is the importance of assuming the first-factor password is already compromised?  How can organizations test controls and alerting for their security posture?    Resources:   View Sherrod DeGrippo on LinkedIn   https://aka.ms/octo-tempest      Related Microsoft Podcasts:   Afternoon Cyber Tea with Ann Johnson   The BlueHat Podcast   Uncovering Hidden Risks    Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.

On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft Senior Security Researcher Graham Dietz. Graham provides intelligence-led recommendations to improve cybersecurity posture in the future. They are creating customer-ready reports and presentations incorporating threat actor attribution, threat detection and hunting guidance, and remediation recommendations. Sherrod and Graham discuss China's extensive history in cyber operations, targeting domestic and international entities, including diplomatic organizations and industrial espionage.      In this episode you’ll learn:       How patriotic hackers are thriving inside the Chinese cybercrime underground  The complexity and diversity of Chinese cyber activities  China's economic strategies and how they relate to cyber operations     Some questions we ask:      What should someone do when handed an unknown USB device by a stranger?  Why does China target organizations without staying completely hidden?  What sets China apart as an advanced persistent threat?    Resources:   View Graham Dietz on LinkedIn   View Sherrod DeGrippo on LinkedIn   Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of The CyberWire Network.