Advertise on podcast: DISCARDED: Tales From the Threat Research Trenches

Send us fan mail! Hello to all our cyber pals!   This week, Selena is joined by Carsten Meywirth, head of the Cybercrime Division at Germany’s Bundeskriminalamt (BKA), to talk about how law enforcement is taking the fight to cybercriminals and why he believes the good guys are gaining ground. With more than 40 years in policing, Carsten traces the BKA’s cybercrime work from a two-person team in the 1990s to a dedicated division of roughly 300 people (and growing). He explains how the threat landscape changed: the rise of the crime-as-a-service economy around 2015, COVID-19 pushing everyone onto remote infrastructure (and criminals taking advantage of it), and Russia’s war against Ukraine accelerating some parts of the ecosystem. . He also describes how investigating cybercrime turns the traditional approach upside down. Investigators start with a victim and a digital crime scene, then follow the traces back to a real person. The conversation covers: What the Conti leaks revealed about ransomware groups that run like corporations, with CEOs, HR departments and IT teamsThe BKA’s four pillars for fighting cybercrime: targeting actors, taking down infrastructure, following the money and disrupting criminal communicationsHow the 2021 Emotet takedown became the model for modern disruption operationsOperation Endgame, the largest public-private partnership cyber operation to date, which goes after droppers and loaders early in the ransomware kill chain, and the anime-style videos designed to spread mistrust in the undergroundWhy personal trust is what makes international and public-private cooperation workThe AI-enabled threats that concern him most, and how investigators are using AI tooWhy he stays optimistic, and the one thing he wants every business leader and government official to understand about cybercrimeTune in to hear how law enforcement and the private sector are coming together to raise the stakes for cybercriminals. As Carsten reminds us, the good guys always win. Resources Mentioned: https://www.bmi.bund.de/SharedDocs/pressemitteilungen/EN/2026/05/lagebild-cybercrime.html https://www.operation-endgame.com/ https://www.europol.europa.eu/how-we-work/operations/operation-poweroff https://www.proofpoint.com/us/blog/threat-insight/stealc-you-later-proofpoint-and-ibm-x-force-support-operation-endgame https://www.proofpoint.com/us/blog/threat-insight/sayonara-socgholish-operation-endgame-disrupts-major-cybercrime-operation For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our cyber party pals!   This week, Selena is joined by co-host Sarah Sabotka (and several very persistent, very uninvited pod crashers) to talk about a threat that's landed in a lot of listeners' personal inboxes lately: malicious event invitations. Selena and Sarah walk through what these lures actually look like — polished, Evite- or Paperless Post-style invitations for birthdays, weddings, baby showers, housewarmings, and even generic "Celebrate with Me" surprises, sent from real, compromised accounts belonging to people the recipient actually knows. Sarah explains why the generic, low-detail invites may be the most effective: they don't require any specific knowledge of the target to feel plausible, and they lean on curiosity and FOMO rather than fear, a notable departure from traditional phishing psychology. The conversation dives into ATO jumping, the mechanism that makes this threat spread so efficiently — once a threat actor compromises one inbox, they mine the contact list and send credential phishing to those contacts, who then get compromised themselves, expanding the reach with every hop. Sarah also connects this lure to established delivery chains like RMM tooling (ScreenConnect, Atera) and credential phishing panels such as TA4903 and "Evil Tokens," which use AI-assisted, sometimes vibe-coded automation to filter, organize, and scale compromised mailboxes rather than to improve the social engineering itself. Selena and Sarah also dig into: Why CAPTCHA and Cloudflare challenges are increasingly bundled into these lures — both to build a false sense of legitimacy and to slow down defenders and researchers trying to analyze the infection chainWhy Microsoft 365 and Google accounts are such high-value targets: they're the hub for cloud documents, financial access, social platforms, and a trusted contact list an attacker can impersonatePractical recovery steps if you've already entered your credentials: revoke active sessions, change your password, enable MFA (passkeys where possible), freeze accounts if financial exposure is a concern, and give your contacts a heads-upWhy smart, security-aware people still fall for these — FOMO and curiosity are natural human responses, not a knowledge gap, and no lure is universal, but there's a lure for everyoneThe FTC's May consumer alert on fake party invitations, and simple habits (a quick text or call to confirm an invite) that can blunt the whole scamPlus: several unannounced podcast "guests" (Tim, Isaac, and Jared) who show up mid-episode having fallen for the very scam being discussed, a genuinely useful tangent on TA2725's shifting tool preferences, and a closing thought on why these lures work in the first place — people miss connecting with each other. Resources Mentioned: Asked to Enter Your Email Address and Password to Open a Party Invite? That's a Scam — Federal Trade Commission https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our cybernauts! This week Selena is joined by not one, not two, but three guests — Mark Kelly, Julia Paluch, and Dave Galazin — to unpack Proofpoint's latest research. Mark walks through how it started: on August 28, the China-aligned actor TA412 (aka Violet Typhoon), previously known mostly for device registration phishing, suddenly began delivering a Chrome exploit — kicking off a frantic cross-team investigation involving partners at Google and Microsoft. Within days, three more state-sponsored clusters adopted the same exploit chain, dubbed BlueMoon; by the time the blog published, that number had grown to seven distinct clusters, plus an eCrime actor and a brand-new espionage group picking it up since. Julia breaks down the Chrome half of the chain — a type confusion bug in the V8 engine chained with a sandbox escape — and introduces the concept of the "patch gap": the roughly four-week window between when a fix is committed to the public Chromium codebase and when it's fully rolled out to stable Chrome releases. During that window, the regression test accompanying the fix effectively doubles as a roadmap for building an exploit, especially with an LLM doing the heavy lifting of interpreting it. Dave then covers the Windows half: a kernel heap bug that lets an attacker escalate from Chrome's heavily sandboxed, untrusted-integrity renderer process straight to full privileges — without needing any file system access first. He and Mark also make the case that this particular Windows exploit had likely been sitting unused for over a year, based on consistent compilation timestamps across the payload's debug information. Selena, Mark, Julia, and Dave also dig into: Why the deployment looked rushed: exploit kits full of debug logging and comments, a downloader left behind indefinitely, and a Windows exploit that doesn't even check what OS the victim is runningHistorical precedent for this kind of rapid multi-actor tool sharing among Chinese threat actors, including 2021's ProxyLogon and 2025's ToolShell activityEvidence pointing toward AI-assisted exploit development — including leftover debugging comments and variable names lifted straight from the public regression testWhether the open-source community's transparency (public commits, public regression tests) needs to change in light of this kind of patch-gap weaponizationWhy Windows zero-days are much rarer to find "on the shelf" than browser bugs, and what that implies about how this one got usedPractical defensive takeaways: post-exploitation detection still matters most, since noisy, AI-assisted tradecraft is easier to catch than the initial exploit itselfPlus: a very enthusiastic Chrome-tab-hoarding discussion, Julia's advice to enable Chrome crash reporting, and a well-earned round of "you need a vacation, Mark." Resources Mentioned: Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880 For more information about Proofpoint, check out our website.

Send us fan mail! Hello to our Cyber Pals!  This week, Selena hands the mic over to a recording of Proofpoint's Intercepted webinar — a monthly video series she co-hosts with Sarah Sabotka — for a deep dive into how cloud brute force attacks are quietly getting more sophisticated. Joining Sarah and webinar host Jason is Rachel Rabin, a threat researcher on Proofpoint's Cloud Threat Research Team, to unpack two spoofing techniques she's seen increasingly weaponized against Microsoft Entra ID environments. Rachel opens with the state of brute forcing today: despite flashier techniques like device code phishing and MFA-resistant phishing kits, brute force remains the most common identity attack vector, with 99% of tenants experiencing some form of it in 2026 — even though success rates typically sit well under 1%. She walks through why first-party Microsoft apps like Azure CLI and Azure AD PowerShell remain the most heavily targeted (publicly known client IDs, gaps in MFA enforcement, and pre-consented scopes), and why the legacy ROPC authentication flow makes credential testing so convenient for attackers. From there, Rachel breaks down two techniques that "level up" traditional brute forcing: User agent spoofing, illustrated by a campaign (later tracked as UNK_CustomCloak) that hit Windows Live Custom Domains — a legacy, discontinued Microsoft app — impacting half a million users across 4,000 tenants using over 600,000 IP addresses and a staggering 7.4 million unique, machine-generated user agent strings.OAuth client ID spoofing, a newer and stealthier technique where attackers submit a syntactically valid but fake client ID to infer whether a password is correct from Entra's error codes, without ever generating a successful sign-in event that would normally tip off defenders. Rachel compares two real-world campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) that appear to have arrived at the technique independently.Sarah, Jason, and the live chat also dig into: Why over-engineering a spoofed user agent can make an attacker easier to spot, not harderHow conditional access policies scoped to the wrong signal (like operating system) can be silently bypassed by a spoofed user agentWhy a failed sign-in shouldn't be dismissed as a non-event. It can still mean a credential has been validatedRachel's practical, "lowest hanging fruit" recommendations: MFA, blocking legacy authentication, layered conditional access, smart lockout policies, and the shift toward passkeysPlus: a shoutout to next month's session on fraud and job scams ahead of Cybersecurity Awareness Month. Resources Mentioned: OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration — Proofpoint

Send us fan mail! Hello to all our cyber stars! Host Selena Larson is joined by co-host Sarah Sabotka, along with returning guest Greg Lesnewich, Principal Threat Research Engineer, and Staff Threat Researcher Mark Kelly, for a follow-up to last episode's half-click deep dive — this time tracking how the technique is spreading beyond TA458 and TA488 into a brand-new Chinese cluster. Greg picks up where last week left off with TA488 (aka Void Blizzard, aka Laundry Bear): after going quiet in February following exposure, the group resurfaced on July 22 — one day before Proofpoint's joint advisory with the NSA — with a new half-click exploit against Microsoft Outlook Web Access. The payload, a previously unseen browser-resident implant called OWAReaper, is built for persistence: it survives credential rotation, browser restarts, and even a full device reimage, and it phones home via GitHub commit messages and image requests proxied through legitimate CDNs like Slack and WordPress. Mark then brings a new actor into the half-click conversation: UNK_MassTraction, a suspected China-aligned cluster exploiting a cross-site scripting flaw in Roundcube to target physics and engineering departments at North American universities — chosen, it turns out, specifically because they were running vulnerable Roundcube instances. The infection chain drops either a webshell or VShell, a Linux backdoor of murky, possibly commercially-developed origin that keeps popping up across Chinese state-sponsored intrusions. The conversation covers: How OWAReaper's persistence differs from anything Greg's seen before — including "poisoning" a user's other emails to reinfect the browser on every new tabWhy Greg's assessment of TA488 shifted from "less capable than TA458" to "neck and neck" after seeing this campaignHow Mark and Greg discovered UNK_MassTraction independently, within hours of each otherWhy UNK_MassTraction's targets were all running vulnerable Roundcube — evidence of deliberate reconnaissance, not spray-and-prayIceCube, the Roundcube stealer with telltale signs of LLM-assisted developmentWhy mail servers are functionally edge devices, and what that means for defenders who can't run EDR on themWhether AI is accelerating adversary tradecraft on both the Russian and Chinese sidesThe ethics of publishing offensive research on a live, evolving techniqueThe funniest (and most unsettling) lure email of the year: "Hi fellow, I really liked your vibe..."Plus: Gus the dog's podcast debut, security awareness training in a world where opening an email can be enough, and shoutouts to Tom Lancaster (Volexity) and Microsoft's patch team. Resources Mentioned: Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit TA488 Targets Zimbra Mailservers with Half-Click Exploits One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our cyber roosters! Host Selena Larson is joined by co-host Sarah Sabatka and returning guest Greg Lesnewich, Principal Threat Researcher at Proofpoint, to unpack two new reports on Russian aligned espionage actors abusing “half-click” exploits, which are vulnerabilities that compromise a target the moment they open an email in a vulnerable webmail viewer, no link or attachment required. Greg breaks down the two distinct actors covered in Proofpoint's research: TA458, a mature, well-resourced group active across multiple webmail platforms (Zimbra, MDaemon, Roundcube, SOGo, and Horde) primarily targeting Ukraine, Eastern Europe, and militaries/ministries of foreign affairs; and TA488 (aka Void Blizzard, aka Laundry Bear), a comparatively scrappier contractor operation that leaned on a single Zimbra zero-day dubbed “ZimReaper” to steal credentials, full mailboxes, and up to 90 days of email history from Ukrainian government and U.S. targets. The conversation covers how the half-click technique works under the hood (stored cross-site scripting via mishandled JavaScript event handlers in webmail HTML), how it differs from traditional phishing, the evidence pointing to a possible link between TA458 and GRU Unit 20728, why TA488's contractor status may explain its skittishness (burning down infrastructure after being outed) versus TA458's higher risk tolerance (including repeatedly firing exploits at targets that weren't even running vulnerable software), and what defenders running Zimbra, Roundcube, or similar platforms can actually do about it. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals! Host Selena Larson is joined by Golo Mühr, Malware Reverse Engineer, X-Force Threat Intelligence and Kyle Cucci (Staff Threat Researcher, Proofpoint) to break down the joint research that helped power a major Operation Endgame disruption.  Coordinated by Europol, the operation hit 66 domains and 296 servers tied to StealC and its close cousin Amadey, and led to the seizure of more than 25.6 million unique credentials stolen from over 385,000 compromised sites. In this episode, Golo and Kyle take us inside the investigation: How they built a custom StealC emulator to impersonate infected bots, talk to live C2 servers, and pull down real second-stage payloadsThe tangled relationship between StealC and Amity, and how shared panels and configs let researchers cluster affiliates togetherWhy StealC sometimes delivers... more StealC (spoiler: probably not a masterplan)A juicy case of "no honor among thieves" — evidence that one affiliate exploited a panel vulnerability to steal from other affiliatesThe one confirmed instance of StealC delivering LockBit Black ransomware, caught in the wild via emulationWhy info stealers have become so attractive to threat actors compared to ransomware — lower risk, easier monetization, less law enforcement heat (until now)What "success" actually looks like in a takedown, and why Kyle's proposed "pyramid of pain" for disruptions puts arrests at the top and infrastructure takedowns at the basePlus: fake software downloads, sketchy YouTube game-crack links, public-private collaboration with law enforcement, and a well-earned shoutout to Proofpoint's Isaac for calling this threat over a decade ago. Tune in for a deep dive into how threat intel teams track, emulate, and ultimately help dismantle one of the internet's most active credential-theft operations. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/stealc-you-later-proofpoint-and-ibm-x-force-support-operation-endgame https://www.proofpoint.com/us/blog/threat-insight/threat-actors-deliver-malware-youtube-video-game-cracks For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals! This week, we present a special replay of "Only Malware in the Building," the podcast that our host, Selena Larson, also co-hosts! Enjoy! Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠DISCARDED⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Keith Mularski⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Qintel⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts dive into the evolving threat of software supply chain attacks and the growing risks facing the open-source ecosystem. As developers increasingly rely on third-party packages and AI-powered coding tools, attackers are finding new ways to abuse trusted software to reach a wider range of targets. The discussion explores why these attacks are becoming more common, what recent incidents reveal about the state of software security, and what organizations can do to better protect themselves. Sources:  ⁠ Shai-Hulud worm returns stronger and more automated than ever before⁠ ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack⁠ What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise

Send us fan mail! Hello to all our Cyber Pals! Host Selena Larson is joined by Sean Farrell, Assistant General Counsel at Microsoft's Digital Crimes Unit (DCU), to pull back the curtain on how major cyber crime takedowns actually happen and how Microsoft uses civil lawsuits, criminal referrals, and global partnerships to disrupt some of the most damaging cyber crime operations in the world. They discuss: What DCU does and Sean's path from FBI to AWS to MicrosoftHow civil claims like the CFAA and RICO are used to seize infrastructureThe Fox Tempest takedown and its ties to Rhysida ransomwareThe global disruption of the Tycoon 2FA phishing-as-a-service operationHow targets get chosen, and civil vs. criminal actionWhy naming victims changes the public narrative on cyber crimeArrests tied to Octo Tempest/Scattered SpiderThe risks of AI-generated sloppiness in legal and threat intel workDisrupting cyber crime isn't about ending it for good, it's about raising the cost of doing business until bad actors run out of road. Resources Mentioned: https://www.microsoft.com/en-us/corporate-responsibility/customer-security-trust/digital-crimes-unit https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/ https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-tycoon-2fa-popular-aitm-phaas For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals! Host Selena Larson is joined by guest host Sarah Sabotka as they chat with returning guest: Alex Pinto, Associate Director of Threat Intelligence at Verizon Business, and the architect behind the Verizon Data Breach Investigations Report.  Alex joins hosts Selena Larson and Sarah Sabatka to break down the most important findings from this year's report — and there's a lot to unpack. From vulnerabilities overtaking credential abuse as the leading initial access vector, to the sobering reality that organizations are patching more but getting worse outcomes, this year's DBIR paints a complex picture of a threat landscape under pressure. The team also digs into the rise of pretexting and voice-based social engineering, what the data actually says about GenAI and threat actors (spoiler: mostly reinventing the wheel — for now), and why third-party and supply chain compromises are quietly becoming one of the biggest stories in security. They discuss: The VERIS framework and why standardization in threat intelligence mattersRansomware taxonomy, data extortion, and why classification is still a headachePretexting vs. phishing — and why they require completely different defensesVulnerability exploitation as the new number one initial access vectorPatching capacity and why outcomes are getting worse despite more effortWhat the DBIR data actually shows about GenAI usage by threat actorsThird-party and supply chain breaches — up 60% year over yearShadow AI and the emerging DLP problem no one's fully ready forA sneak peek at Verizon's upcoming cost-of-a-data-breach reportThe DBIR drops once a year — make sure you're getting the most out of it with this breakdown straight from the source, all 121 nutritious, fiber-rich pages of it. Resources Mentioned: 2026 DBIR For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! What does it actually look like to bring AI into a threat intelligence program at one of the internet's most iconic companies? Hello to all our Cyber Pals! Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Sean Zadig, Chief Information Security Officer (and "Chief Paranoid") at Yahoo, for a candid conversation about the evolving intersection of AI and cybersecurity. Sean shares how Yahoo's security team, the Paranoids, is navigating the agentic AI transformation: from running a company-wide "skill-a-thon" to get every team member building Claude-powered tools, to rethinking legacy infrastructure from the ground up. He also opens up about what keeps him up at night; including the looming threat of AI-powered exploit frameworks like Mythos, the growing signal-to-noise problem in threat intel feeds, and the very real risk of analyst burnout as the pace of the industry accelerates. But Sean's outlook is surprisingly optimistic. He argues that defenders have a home-field advantage, that the best code ever written is just 12–18 months away, and that the goal of AI in security shouldn't be doing more with fewer people–it should be building more resilient teams. For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Sunbeams! Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Jake Gionet to unpack one of the fastest-growing threats in today’s cyber landscape: device code phishing. What started as a niche technique used in red team exercises has quickly evolved into a widely adopted method for account takeover—fueled by publicly available phishing kits and accelerated by AI-assisted tooling. The trio breaks down how device code phishing works, why it’s suddenly everywhere, and how attackers are exploiting legitimate authentication flows to bypass traditional defenses. They also explore the rise of “phishing-as-a-service” platforms like Evil Tokens, the surprising lack of sophistication behind many campaigns, and how AI is both enabling attackers and exposing their mistakes. Along the way, they dig into real-world examples, threat actor missteps, and the blurry line between innovation and imitation in cybercrime. If you’ve been hearing the buzz around device code phishing and want a clear, grounded explanation—without the hype—this episode delivers. Plus, practical insights on what defenders should actually focus on as these techniques continue to evolve. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals, Cyber Centaurs, Cyber Stars, and listeners who have been with us for 100 episodes! It’s our 100th episode—and we’re raising a glass to celebrate. 🥂 Host Selena Larson is joined by long-time guest hosts, Sarah Sabotka and Tim Kromphardt, and honorary host, VP of Proofpoint Threat Research Daniel Blackford, for this commemorative episode of Discarded! We reflect on the journey so far, revisit standout moments, and look ahead to what’s next in cybersecurity. From unforgettable guests and inside jokes to real lessons learned from years of tracking threat actors, this episode is part celebration, part reflection, and part unfiltered cyber chat. We dig into: Favorite podcast guests and the insights that stuck with usThe reality vs. hype of AI in cybersecurity (and what’s actually useful)How threat actors are evolving—and where they’re… notThe surprising truth about targeting, myths in the industry, and why attackers don’t need to be sophisticated to be effectiveBehind-the-scenes looks at the tools and research we’re building right nowPlus, we answer listener questions, share a few laughs (and a few drinks), and talk about what the next 100 episodes might hold. Whether you’ve been with us since episode one or just discovered the show, this milestone episode is a thank-you to our listeners—and a reminder that cybersecurity is as much about people as it is about technology. Cheers to 100 episodes. 🍾 Resources Mentioned: https://www.nytimes.com/2026/04/04/technology/ai-chatbots-teen-roleplay.html For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Daffodils! Host Selena Larson, and guest Host, Tim Kromphardt, sit down with Stuart Del Caliz, Senior Threat Detection Engineer at Proofpoint, to unpack the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden. From magic packets and port knocking to sophisticated backdoors like BPFdoor, Stuart shares how attackers design covert communication methods—and how defenders work to uncover them without overwhelming security teams with noise. The conversation blends deep technical insight with real-world analogies (think speakeasy knocks and undercover “internet cops”) to make complex detection strategies easier to understand. You’ll also hear: How detection engineers balance accuracy and performance when writing IDS/IPS signaturesWhy some advanced malware can remain undetected for years—and whether we’re simply not seeing itHow historic leaks like Shadow Brokers still influence modern attack techniquesThe role of “pattern matching” in identifying evolving malware behaviorsHow file metadata and revoked certificates can reveal threats hiding in plain sightWhy community collaboration and feedback loops are critical to stronger detectionsWhether you’re a security practitioner or deep in the trenches, this episode offers a closer look at the craft of detection engineering—and the constant challenge of writing high-fidelity detections against increasingly evasive threat techniques. Resources Mentioned: https://community.emergingthreats.net/ https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/ https://www.wired.com/story/nsa-hacking-tools-stolen-hackers/ https://github.com/x0rz/EQGRP For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals! Guest host Sarah Sabotka sits down with Senior Threat Researcher Jared Peck to unpack one of the most dynamic and persistent cybercrime groups operating today: TA2725, also known as “Grana.” From its roots in Latin America to its global reach, TA2725 stands out for its adaptability—and its relentless pursuit of financial gain. Jared shares how the group evolved from a high-volume malware operator into a multifaceted threat actor running phishing, fraud, and malware campaigns simultaneously. The conversation dives into how Grana targets regions like Brazil and Mexico, why their tactics shift across geographies, and what makes their operations uniquely complex. You’ll also hear: How threat actors “graduate” to official TA designations (and why it’s a big win for researchers) The impact of law enforcement disruptions on major malware operations like Grandoreiro Why Latin America’s banking infrastructure shapes cybercrime tactics differently The rise (and fall) of RMM tools in TA2725’s playbook What clues reveal whether activity comes from one group—or an entire cybercrime “service” ecosystemWhether you’re in cybersecurity or just curious about how modern cybercrime operates, this episode offers a fascinating look at a threat actor that refuses to stay in one lane—and what that means for organizations worldwide. For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!