Advertise on podcast: DISCARDED: Tales From the Threat Research Trenches

Send us fan mail! Hello to all our Cyber Pals! Host Selena Larson and co-host, Tim Kromphardt, chat with Rich Gonzalez, Director of Emerging Threats at Proofpoint, to kick off 2026 with a behind-the-scenes look at how emerging threats are detected, tracked, and turned into real-world protections for defenders. They explore what it really takes to keep pace with an always-on threat landscape, from rapid response to newly released proof-of-concepts, to why certain vulnerabilities like Log4j continue to dominate attacker activity years later. The conversation also digs into alert fatigue, the realities of SOC burnout, and where automation and AI can genuinely help versus where trust, accuracy, and human judgment still matter most. In this episode, they cover: How Proofpoint’s Emerging Threats team monitors global attacker behavior and delivers fast, high-confidence detectionsWhat happens behind the scenes when a proof-of-concept drops (especially during holidays)Why some CVEs remain “evergreen” targets and never truly go awayThe balance between speed and accuracy in rule writing without overwhelming SOC teamsWhere AI and machine learning are being used today to reduce tedious work and improve triageThe risks of over-automation, hallucinations, and untrusted intelligence in security workflowsWhat’s coming in 2026, including more frequent rule releases and more detection coverage This episode offers a candid, practitioner-driven view of modern threat detection—highlighting why adaptability, transparency, and human expertise remain essential as defenders head into 2026.

Send us fan mail! Hello to all our Cyber Elves! Host Selena Larson chats with Daniel Blackford, Vice President of Threat Research at Proofpoint, for an end-of-year look at how the cyber threat landscape evolved—and what defenders should be preparing for in 2026. They reflect on how the second half of 2025 brought meaningful shifts in attacker behavior, with familiar techniques becoming more professionalized and new malware emerging alongside identity-focused attacks. The conversation also explores why attribution is getting harder, how law enforcement disruptions are reshaping cybercrime ecosystems, and where AI is genuinely helping defenders versus introducing new risks. In this episode, they cover: How attacker tactics “proliferated” in 2025 rather than fully reinvented The return of new malware families alongside loaders and backdoors Why identity, social engineering, and legitimate tools (RMMs, device code phishing) remain top attack vectors The real-world impact of law enforcement takedowns like Operation Endgame How shared tooling and services are blurring attribution across threat actors Practical, no-hype perspectives on AI, machine learning, and defender workflows What organizations should focus on now to stay resilient in 2026 This episode offers a grounded, experience-driven perspective on what actually mattered in 2025—and why strong fundamentals, layered defenses, and adaptability remain the best preparation for whatever comes next. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/remote-access-real-cargo-cybercriminals-targeting-trucking-and-logistics https://www.proofpoint.com/us/blog/threat-insight/operation-endgame-quakes-rhadamanthys https://www.proofpoint.com/us/blog/threat-insight/security-brief-venomrat-defanged https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-ru-2025-1022.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/2025/01/lee_2025_ai_critical_thinking_survey.pdf For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Happy Holidays to all our Cyber Pals! Host Selena Larson, and co-guest ho-ho-ho hosts, Tim Kromphardt & Sarah Sabotka unwrap the surprising (and sometimes clever) ways cybercriminals use seasonal themes to trick both consumers and enterprises. From fake party invites and too-good-to-be-true discounts to holiday-flavored malware and RMM delivery, the team breaks down how threat actors capitalize on increased spending, lower vigilance, and year-end business pressure. They share real examples—like “free Christmas tree” scams, fake travel itineraries, smishing campaigns, and even malware hidden behind a Christmas caroling invitation. You’ll also hear: 🎁 Why holiday-themed lures work so well 🎁 How scammers tailor their tactics to shifting consumer behavior  🎁 The rise of SMS scams, malvertising, and SEO-poisoned shopping searches  🎁 What enterprises should watch for as employees mix work and personal activity  🎁 Why energy drinks are (shockingly) a hot commodity in cargo theft schemes  🎁 Practical tips to stay safe—whether you’re holiday shopping or closing year-end invoices Before you head off for vacation, join us for a fun, insightful, and very festive breakdown of the seasonal threats that might be landing under your digital tree this year. For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Squirrels! Host Selena Larson, and guest host, Tim Kromphardt sit down with Tony Robinson — Senior Security Research Engineer and “rule magician” from Proofpoint’s Emerging Threats team. Tony shares the story behind IoT Hunter, an open-source tool he created to automate writing detection rules for Internet of Things (IoT) vulnerabilities. From routers and smart cameras to industrial control systems, Tony breaks down how IoT Hunter helps researchers and defenders cover hundreds of CVEs — from long-forgotten exploits to newly discovered zero-days. The trio dives into: Why IoT devices remain a major attack vector for threat actors and botnets What kinds of vulnerabilities IoT Hunter detects (and how it’s not AI) The surprising persistence of outdated frameworks like Boa HTTPd Real-world examples of IoT exploitation — from ransomware via smart cameras to botnets made of toasters Practical steps anyone can take to secure home and small business devices This episode uncovers the risks and realities behind our increasingly connected world — and how automation and community collaboration are helping defenders keep up. Resources Mentioned: community.emergingthreats.net https://community.emergingthreats.net/t/iot-hunter-public-release/3024 https://community.emergingthreats.net/t/cybersecurity-awareness-month-iot-and-soho-devices/3095 For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Squirrels! Can hackers make great public servants?  Host Selena Larson, and co-guest hosts, Sarah Sabotka and Tim Kromphardt sit down with Andrew Brandt, Founder and Executive Director of Elect More Hackers — a nonprofit on a mission to get more cybersecurity and tech-minded thinkers into elected office. Together, they explore how hackers and technologists can bring their problem-solving mindset into civic life — from teaching digital safety at local libraries to advising lawmakers on cyber hygiene, data privacy, and AI policy. Andrew unpacks why infosec professionals are uniquely equipped to tackle systemic issues like the “enshittification” of online platforms, the right-to-repair movement, and the privacy nightmare of “smart” cars. The conversation dives into the surprising cybersecurity gaps in government, how social engineering and lobbying overlap, and why civic engagement shouldn’t stop at voting. You’ll also hear how even small acts — like community outreach or helping shape local school tech policies — can lead to smarter, safer public systems. Whether you’re a hacker or a policy nerd this episode will inspire you to plug in locally, build trust, and maybe even run for office yourself. 🎙️ Tune in to learn: Why hackers and technologists make great problem-solvers in politics How policies like right-to-repair and data privacy affect everyone Practical ways cybersecurity professionals can engage civically — even without running for office Think civic engagement isn’t for you? Think again — this conversation shows how even small actions from tech-minded thinkers can create big change. Resources Mentioned: 🔗 Learn more: electmorehackers.com For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Sleuths! Host Selena Larson, and guest host, Sarah Sabotka take you behind the scenes of the ever-changing world of cybercrime—where attackers innovate, scams evolve, and staying one step ahead is a constant challenge. From remote monitoring and management (RMM) abuse to adversary-in-the-middle (AiTM) phishing, web injects, flashy malware lures, and the latest wave of information stealers, we unpack the tactics, techniques, and procedures shaping today’s threat landscape. We talk about: Why attackers are leaning on RMM tools and what you can do to defend yourself or your organization.How MFA-aware phishing kits are evolving and ways to stay secure.New information stealers emerging in the wake of law enforcement disruptions.The role Reddit can play in helping spot real-world scams.The human side of cyber crime, from fraud and job scams to societal pressures driving people into schemes.The exponential growth of web injects and unique social engineeringThe cunning tactics of threat actors like TA582 Along the way, we share practical tips for staying safe online—closing suspicious tabs, using MFA, blocking unsolicited links, and even taking mindful breaks from the digital world.  This episode helps you understand the chaos of the digital underworld and stay one step ahead—without throwing your phone into the woods. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice https://www.proofpoint.com/us/blog/threat-insight/when-monster-bytes-tracking-ta585-and-its-arsenal https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Pumpkin Spice Cyber Friends! It’s Cybersecurity Awareness Month — and what better way to kick it off than with a deep dive into the human side of cyber threats? In this episode host Selena Larson welcomes back guest and part-time co-host Sarah Sabotka, our “Cybersecurity Awareness Month Queen” and Staff Threat Researcher at Proofpoint. She joins us to break down why social engineering is at the heart of so many attacks. We take a closer look at how scams and social engineering tactics are growing more sophisticated—and how the real battleground isn’t just your inbox, it’s your brain. Our guest explains “amygdala hijacking,” the psychological manipulation behind scams, and why recognizing your emotional responses during suspicious interactions can be just as important as spotting technical red flags.  We also focus on protecting some of the most vulnerable—seniors and young digital natives—highlighting community education programs, interactive teen cybersecurity trainings, and strategies for safe social media use, password hygiene, and multi-factor authentication. We also talk about: Why Awareness Month feels different this year and how communicators are packaging complex threat research for real people. The neuroscience behind social engineering (shoutout to Dr. Bob, Proofpoint’s lead cognitive scientist) and a simple, powerful takeaway: trust your gut. Concrete examples: ClickFix scams, deepfakes used against small businesses, LLM-enabled phishing, benign-conversation lures (smishing & job scams), and multi-step attacks that prime victims over time. Practical steps to protect yourself and your org — safe words, pause-and-check habits, and why peer stories beat scary slides. Tune in and learn how to build better cyber awareness for everyone in your life—because cybersecurity isn’t just for IT teams, it’s for all of us. Resources Mentioned: https://www.proofpoint.com/us/resources/threat-reports/human-factor-social-engineering https://www.proofpoint.com/us/blog/security-awareness-training https://www.proofpoint.com/us/blog/threat-insight/best-laid-plans-ta453-targets-religious-figure-fake-podcast-invite-delivering https://www.clickorlando.com/news/local/2025/02/19/central-florida-wildlife-rescue-falls-victim-to-podcast-scam-warns-others/ https://abc7.com/post/scam-texts-targeting-people-looking-jobs-are-rise-ftc-warns/17838427/ https://www.cbc.ca/news/marketplace/sextortion-teen-boys-canada-1.7648267 https://www.consumerreports.org/media-room/press-releases/2025/10/consumer-reports-study-finds-surge-in-texting-and-messaging-scams For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Welcome in! You’ve entered, Only Malware in the Building — but this time, it’s not just another episode. This is a special edition you won’t want to miss. For the first time, our hosts are together in-studio — and they’re turning up the heat. Literally. Join ⁠⁠⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠⁠⁠⁠DISCARDED⁠, along with ⁠⁠⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠Keith Mularski⁠⁠⁠⁠⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠⁠⁠Qintel⁠⁠⁠⁠⁠⁠⁠⁠⁠, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you’ve seen them tackle malware mysteries before? Wait until you see them sweat. This one’s too good for audio alone — you’ll want to watch the full ⁠video⁠ edition to catch every spicy reaction, every laugh, and maybe even a few tears. So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building.

Send us fan mail! Hello to all our Cyber Stars! In this episode host Selena Larson welcomes back guest and part-time co-host Tim Kromphardt, fresh from DEFCON, to explore the world of request-for-quote (RFQ) fraud—a growing scam targeting small- to medium-sized businesses with fake purchase requests and net financing schemes. Tim explains how cybercriminals exploit legitimate business practices to steal physical goods like networking tools, surveillance equipment, and medical devices. Using stolen business credentials, fake domains, and freight forwarding services, these scams combine social engineering with real-world theft. He shares firsthand stories of engaging with scammers directly, taking down fraudulent domains in real time, and even halting shipments in transit. Selena and Tim break down how these schemes operate, the sophistication of scammers and why smaller, specialized companies are often targeted. They also provide practical tips for spotting and avoiding these scams, from verifying domains and emails to independently confirming contacts and addresses. Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/net-rfq-request-quote-scammers-casting-wide-net-steal-real-goods For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Squirrels! In this extra-packed episode of Discarded, host Selena Larson welcomes Proofpoint Principal Research Engineer Jason Ford for his first appearance on the show. Together, they dive into two resurging email attack techniques—Microsoft 365 Direct Send abuse and URL rewrite abuse—and why defending against them requires more than just traditional email security. Jason explains what Direct Send is, why attackers exploit this legacy feature, and how it enables phishing campaigns that appear to originate from inside an organization. From QR code phishing kits to “to-do list” themed lures, Selena and Jason break down attack chains, share real-world examples, and highlight the red flags that indicate exploitation. They also explore how adversaries weaponize URL rewrites in redirect chains, to deliver malware and credential phishing.  We also unpack:  How Direct Send works under the hood and why legacy features are a prime target Common signs in email headers that reveal Direct Send abuse The role of URL rewrites in modern phishing campaigns Why credential phishing has overtaken malware as the go-to tactic Practical steps organizations can take—including when it makes sense to disable Direct Send The importance of layered defenses, user education, and risk awareness across SaaS apps Predictions on which “old school” techniques might resurface next This episode offers a clear, actionable look at how threat actors adapt and why everything old in cybercrime eventually becomes new again.  Resources Mentioned: https://www.proofpoint.com/us/blog/email-and-cloud-threats/attackers-abuse-m365-for-internal-phishing http://www.jasonsford.com https://github.com/jasonsford/directsendanalyzer  For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Panda Bears! In this extra-packed episode of Discarded, host Selena Larson and guest host, Sarah Sabotka reunite with Staff Threat Researcher Mark Kelly to dive deep into China-aligned espionage activity—this time with a focus on Taiwan’s semiconductor ecosystem and the strange, stealthy tools threat actors are using to get in. Mark walks us through Proofpoint’s latest research on custom malware (yes, “Voldemort” is back), threat clusters with pun-filled names like UNK_SparkyCarp and UNK_DropPitch, and why Taiwan’s chip industry has become such a hot target. From design and manufacturing to financial analysts and supply chains, Chinese state-aligned actors are getting more creative—and more persistent. We also unpack:  The “Phish & Chips” campaign and how it fits into China’s broader geopolitical strategy  Why pop culture references like Voldemort and Mr. Robot keep showing up in espionage infrastructure Attribution headaches, including Proofpoint’s tracking of multiple unattributed threat clusters with UNK designators  How AI, LLMs, and adversary-in-the-middle phishing are influencing espionage tactics  The use of RMM tools and spoofed MacOS folders for stealth  Why basic backdoors are making a strategic comeback  A threat intel team’s deep love for vegetables, puns, and report titles Whether you're tracking state-sponsored cyber activity, curious about weird malware names, or just here for the expert banter, this episode has you covered. Resources Mentioned: Phish & Chips: Chinese Espionage Activity Targeting Taiwan's Semiconductor Ecosystem For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our cyber pals! In this episode of Discarded, host Selena Larson and co-host, Tim Kromphardt, are joined by Joe Wise, Senior Threat Researcher at Proofpoint for a deep dive into the chaotic brilliance of mid-tier eCrime actors—including the elusive TA582. We explore recent activity from TA2541 and TA558—two groups known for their uncanny consistency and precision targeting—before shifting focus to TA582: a standout in today’s threat landscape. TA582’s multilayered, region-specific lures (think vintage car sales and fake speeding tickets) and complex delivery models are impressive compared to your typical cybercriminal. Topics Include: 🔍 What you’ll hear: How TA2541 and TA558 maintain eerily consistent lures and targeting year after year The regional flavor behind lures in Latin America and Europe—especially during tax season Why TA582 feels like a digital jigsaw puzzle, with simultaneous email, web inject, and compromised site vectors A breakdown of TA582’s evolving payloads, from GhostWeaver to Interlock RAT The surprising links between threat actor collaboration, initial access brokers, and shifting loader trends How weird or silly variable names can enable threat actor trackingAnd yes—13 URLs that needs the Tron soundtrack playing in the background to explore For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our cyber detectives and pedantic CTI friends! In this episode of Discarded, host Selena Larson is joined by Greg Lesnewich, Staff Threat Researcher at Proofpoint for a behind-the-scenes look at one of the most frustratingly fascinating attribution cases yet. What begins as a lighthearted rant: “10 Things I Hate About Attribution,” quickly turns into a deep dive into the murky overlap between TA829 (aka RomCom), TA289, and the elusive GreenSec cluster. From TransferLoader and malware panels to REM proxy infrastructure and attack chain similarities, Greg and Selena dissect the breadcrumb trail that led to a 25-page blog, a mountain of malware chains (Dusty Hammock? Single Camper?), and an attribution headache.  Topics Include: TA829 (aka RomCom) and the elusive GreenSec cluster: What’s the difference? Vertical targeting overlap (and divergence) Malware breakdown: TransferLoader vs. RomCom and related malware Use of REM proxy and rebrand.ly infrastructure Attribution logic and the perils of shared tooling Bonus: Existential mysteries and karaoke mic commentary The attribution game isn’t always about getting it right—it’s about asking better questions. Join us in the mess, and keep connecting the dots. For more information about Proofpoint, check out our website. Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Pals! In this episode of Discarded, host Selena Larson and co-host Sara Sabotka are joined by Saher Naumaan and Greg Lesnewich, teammates on the espionage threat research team at Proofpoint to unravel the multifaceted—and often bizarre—world of North Korean cyber operations.  The team explores: What sets DPRK’s threat actors apart from other nation-state groupsA closer look at North Korea’s cyber and physical support for Russia in UkraineHow cyber activity plays a central role in North Korea’s national strategy—not just a supporting one The phishing-heavy tactics of groups like TA427 (“Old Reliable”) and the emergence of oddball clusters like “Contagious Interview” and “UNK RageQuit” How North Korean actors blur the lines between espionage and financially motivated cybercrime The murky world of North Korean IT workers infiltrating global tech companies under false identities—raising critical questions about workplace exposure, ethics, and potential defections The surprising ways some of these operatives sabotage themselves, including infections with common malware that expose their digital behavior And yes, a Microsoft spoofing campaign actually using Comic Sans North Korean cyber activity is evolving fast and they explain why it deserves far more attention than it gets.    Resources Mentioned: https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front https://spycloud.com/blog/spycloud-march-cybercrime-update/ https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-threat-insight-paper-triple-threat-N-Korea-aligned-TA406-steals-scams-spies.pdf For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail! Hello to all our Cyber Masked Vigilantes!  In this episode of Discarded, host Selena Larson and co-host Tim Kromhardt are joined by James Emery-Callcott, a Security Researcher on Proofpoint’s Emerging Threats team, for an insider’s look at the technical, tactical, and collaborative forces shaping modern network detection. James takes us behind the curtain of rule writing, CVE coverage, and malware detection, breaking down how signatures are developed, validated, and deployed to protect against a constantly shifting threat landscape. From the fading heyday of exploit kits to the rise of infostealers and ClickFix, we explore how detections evolve—and why the most persistent threats often hinge on the fundamentals of networking. You’ll also hear how the team maps detection rules to frameworks like MITRE ATT&CK and CISA KEV, using metadata tags to reduce alert fatigue and prioritize real-world risks. James shares why this kind of tagging isn’t just technical polish—it’s operational gold. But detection doesn’t happen in a vacuum. James explains how the community—through Discord chats, support tickets, and collaborative research—plays a vital role in surfacing false positives, sharing POCs, and suggesting metadata improvements.  Bonus highlights include: Why writing reliable detection rules is still too nuanced for AI The anatomy of a CVE rollout (and the surprising role of an Xbox controller) Signature performance testing and hardware challenges Why older vulnerabilities still matter A sneak peek at a free Suricata training series in the works Whether it’s a shoutout to Tony for pushing tagging innovation or a nod to students eager to get started, the message is clear: everyone can contribute to better detection.   Resources Mentioned: CrazyHunter: https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html https://www.proofpoint.com/us/blog/threat-insight/emerging-threats-updates-improve-metadata-including-mitre-attck-tags For more information about Proofpoint, check out our website.   Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!