Show Notes
It's that time of the quarter again when we sit down to look at what we learned over the past three months. Caitlin Huey from the Talos Threat Interdiction Team joins the show for this special look at the latest Talos Incident Response Quarterly Trends report. Caitlin's team helps compile these reports and digs through mountains of data to find out what defenders can learn from what Talos IR is seeing live in the field. If you want to learn more about this report, you can read it on our blog,...
More from Beers with Talos Podcast
David Bianco built the Pyramid of Pain, so we offered him some more. David joins the crew for a conversation how AI changes about his famous model, how EvidenceForge creates simulated incidents for research and training, and why his red-team entrance exam didn’t go to plan. First, we discuss the newly disclosed PHP vulnerabilities and the potential impact there (we recorded this on day 1 of the disclosure, hence expediting the release of this episode from its normal release schedule). L...
How do you get under a cybercriminal’s skin? Sometimes you expose their operations. Sometimes you make every step through a network painfully slow. And sometimes, if you’re Azim, you join a dark web forum where they’re insulting you, and help them do it. Azim and Nick join Hazel and Dave this week to discuss the fine art of frustrating adversaries, from ransomware-group paranoia to deception that wastes their time and gives defenders a chance to spot their activity. For more on this topic, ch...
Adversaries are experimenting with AI-integrated malware, and today's guest, Talos researcher Ryan Fetterman has been looking at their working notes. He joins us to talk about CAIRN, his new open-source research toolkit for tracking that experimentation, and what he’s finding, including a C2 an implant that delegates its decisions to AI models, and malware that tries to persuade AI analysis tools to leave it alone. Putting AI in malware is one thing. Establishing whether any of it actually wo...
Twenty-four hours before recording this episode, Martin Lee stopped being a Talos employee. Naturally, we made him come on the podcast anyway. Martin talks about abandoning his early career aspirations of researching human viruses and curing cancer, so he could play on the internet. He also talks about how running very long distances in crazy conditions helps him to stop himself thinking about it. He has some words of wisdom for aspiring practitioners, and why the rest of us should occa...
What does it take to become someone a cybercriminal will trust? Talos' Azim Khodjibaev takes us inside the psychology of direct adversary engagement. At one point, he was maintaining eight different personas, some of which were talking to each other. He explains how discipline and patience help keep his cover intact, and what can provoke threat actors into revealing information. His work has occasionally made Azim part of the story. Ransomware operators have threatened him, and on...