Beers with Talos Ep. #107: Sailing the high seas in search of privateer groups

How do you get under a cybercriminal’s skin? Sometimes you expose their operations. Sometimes you make every step through a network painfully slow. And sometimes, if you’re Azim, you join a dark web forum where they’re insulting you, and help them do it. Azim and Nick join Hazel and Dave this week to discuss the fine art of frustrating adversaries, from ransomware-group paranoia to deception that wastes their time and gives defenders a chance to spot their activity. For more on this topic, ch...

Adversaries are experimenting with AI-integrated malware, and today's guest, Talos researcher Ryan Fetterman has been looking at their working notes. He joins us to talk about CAIRN, his new open-source research toolkit for tracking that experimentation, and what he’s finding, including a C2 an implant that delegates its decisions to AI models, and malware that tries to persuade AI analysis tools to leave it alone. Putting AI in malware is one thing. Establishing whether any of it actually wo...

Twenty-four hours before recording this episode, Martin Lee stopped being a Talos employee. Naturally, we made him come on the podcast anyway. Martin talks about abandoning his early career aspirations of researching human viruses and curing cancer, so he could play on the internet. He also talks about how running very long distances in crazy conditions helps him to stop himself thinking about it. He has some words of wisdom for aspiring practitioners, and why the rest of us should occa...

What does it take to become someone a cybercriminal will trust? Talos' Azim Khodjibaev takes us inside the psychology of direct adversary engagement. At one point, he was maintaining eight different personas, some of which were talking to each other. He explains how discipline and patience help keep his cover intact, and what can provoke threat actors into revealing information. His work has occasionally made Azim part of the story. Ransomware operators have threatened him, and on...

Kaitlin Acharya joins the Beers with Talos crew to take us inside the world of threat intelligence: what happens when Talos spots something that could become a major threat, how her team tracks changes in threat actor behavior, and how intelligence moves from an investigation into detection content. She also faces some tougher questions involving tennis, Derry Girls and an evil genie. We also attempt to extract some information about Kaitlin’s former life at a certain intelligence agency. Res...