Impersonation of cybersecurity firms by threat actors as part of callback phishing attacks.Luna Moth becomes the latest attack group to perform Ransomware style extortion without encryption.Searchable data leak sites gain traction among threat actors as new leverage tool.

Impersonation of cybersecurity firms by threat actors as part of callback phishing attacks.Luna Moth becomes the latest attack group to perform Ransomware style extortion without encryption.Searchable data leak sites gain traction among threat actors as new leverage tool.

Threat Bulletin #178

Ransomware affiliates spoof US companies to obtain new red team tools as they pivot away from Cobalt Strike.Hive ransomware strain is completely re-written in Rust, gaining faster encryption among other benefits.Microsoft reverses change popular among InfoSec community, no longer disabling document macros by default.

Ransomware affiliates spoof US companies to obtain new red team tools as they pivot away from Cobalt Strike.Hive ransomware strain is completely re-written in Rust, gaining faster encryption among other benefits.Microsoft reverses change popular among InfoSec community, no longer disabling document macros by default.

Threat Bulletin #177

Mitel phone bug exploited to perform ransomware attack.Lockbit 3.0 introduces first ransomware bug bounty program.AMD reportedly suffers attack and data is currently held for ransom.

Mitel phone bug exploited to perform ransomware attack.Lockbit 3.0 introduces first ransomware bug bounty program.AMD reportedly suffers attack and data is currently held for ransom.

Threat Bulletin #176

New variation of PetiPtoam flaw dubbed DFSCoerce can allow windows domain takeover.Okta discusses Lapsus$ breach and how zero trust helped secure network from worse effects.A collection of 56 flaws dubbed Icefall degrades security posture of thousands of OT devices.

New variation of PetiPtoam flaw dubbed DFSCoerce can allow windows domain takeover.Okta discusses Lapsus$ breach and how zero trust helped secure network from worse effects.A collection of 56 flaws dubbed Icefall degrades security posture of thousands of OT devices.

Threat Bulletin #175

New Symbiote Linux malware has several concerning stealth, obfuscation, and rootkit style techniques.Emotet returns, featuring a similar codebase, but a host of new tricks.Report highlights how non admin 0365 access could be used to sabotage/encrypt cloud files.

New Symbiote Linux malware has several concerning stealth, obfuscation, and rootkit style techniques.Emotet returns, featuring a similar codebase, but a host of new tricks.Report highlights how non admin 0365 access could be used to sabotage/encrypt cloud files.

Threat Bulletin #174

Two recent flaws can be combined to create very sophisticated phishing attacks.Dridex authors EvilCorp become a LockBit affiliate, likely in another effort to evade sanctions.POC code released for “trivial” to exploit Atlassian Confluence vulnerability.

Two recent flaws can be combined to create very sophisticated phishing attacks.Dridex authors EvilCorp become a LockBit affiliate, likely in another effort to evade sanctions.POC code released for “trivial” to exploit Atlassian Confluence vulnerability.

Threat Bulletin #173

New Chromeloader malware employs stealthy installation and persistence methods.New MS Office zero day allows “no click” powershell exploitation even with macros disabled.

New Chromeloader malware employs stealthy installation and persistence methods.New MS Office zero day allows “no click” powershell exploitation even with macros disabled.

Threat Bulletin #172 

Information on a Russian botnet designed to manipulate social media trends and spread disinformation, facial recognition technology Clearview AI is fined by the UK government and an Iranian threat group target the port of London authority. 

Information on a Russian botnet designed to manipulate social media trends and spread disinformation, facial recognition technology Clearview AI is fined by the UK government and an Iranian threat group target the port of London authority.

Threat Bulletin #171

New modular Eternity malware being offered via TelegramConti appears to encourage overthrowing the Costa Rican governmentConti reportedly shuts down, splintering into smaller cells and operations.

New modular Eternity malware being offered via TelegramConti appears to encourage overthrowing the Costa Rican governmentConti reportedly shuts down, splintering into smaller cells and operations.

Threat Bulletin #170

US sanctions crypto laundering service used by the North Korean Lazarus group.Full featured Russian RAT DarkCrystal is selling perpetual licences for a mere $40.US offers a $15,000,000 bounty for information leading to the Conti overlords.

US sanctions crypto laundering service used by the North Korean Lazarus group.Full featured Russian RAT DarkCrystal is selling perpetual licences for a mere $40.US offers a $15,000,000 bounty for information leading to the Conti overlords.

Threat Bulletin #169

Talion Threat Set Radio is your weekly cyber threat intelligence bulletin.  We cut through the noise to give you our honest opinion on the threat news that matters.

Confirmation of REvils return as new sample is obtained and analysed.New technique discovered involving hiding payload in Windows Event Logs.Ukraine affiliated hacktivists target Russian alcohol production pipeline.

Confirmation of REvils return as new sample is obtained and analysed.New technique discovered involving hiding payload in Windows Event Logs.Ukraine affiliated hacktivists target Russian alcohol production pipeline.

Threat Bulletin #168

Bumblebee appears to replace BazarLoader as Conti’s delivery vector of choice.Emotet returns to full operation, more than a year after coordinated takedown.FBI circulates warning regarding new BlackCat ransomware strain.

Bumblebee appears to replace BazarLoader as Conti’s delivery vector of choice.Emotet returns to full operation, more than a year after coordinated takedown.FBI circulates warning regarding new BlackCat ransomware strain.

Threat Bulletin #167

No 10 suspected of being target of NSO spyware attack, U.S. offers $5 million for info on North Korean cyber operators &amp; notorious cybercrime gang’s botnet ZLoader disrupted

<a href="https://www.theguardian.com/politics/2022/apr/18/no-10-suspected-of-being-target-of-nso-spyware-attack-boris-johnson" rel="nofollow" target="_blank">No 10 suspected of being target of NSO spyware attack</a>, <a href="https://therecord.media/u-s-offers-5-million-for-info-on-north-korean-cyber-operators/" rel="nofollow" target="_blank">U.S. offers $5 million for info on North Korean cyber operator</a>s &amp; n<a href="https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/" rel="nofollow" target="_blank">otorious cybercrime gang’s botnet ZLoader disrupted</a>

Threat Bulletin #166

Raidforums seized, owner and operator arrested after running the site since the age of 14.Microsoft works with US government to dismantle operations targeting Ukraine.In an act of poetic justice, Conti source code is repurposed to attack Russian targets.

Raidforums seized, owner and operator arrested after running the site since the age of 14.Microsoft works with US government to dismantle operations targeting Ukraine.In an act of poetic justice, Conti source code is repurposed to attack Russian targets.

Threat Bulletin #165

Intel completely shuts down business in Russia, exacerbating component shortage fears.German investigators shut down Hydra, the largest illegal Darkweb marketplace.Borat remote access trojan, with ransomware and other capabilities, offered for sale.

Intel completely shuts down business in Russia, exacerbating component shortage fears.German investigators shut down Hydra, the largest illegal Darkweb marketplace.Borat remote access trojan, with ransomware and other capabilities, offered for sale.

Threat Bulletin #164

Chinese security researcher accidentally releases spring framework PoC exploit.Raccoon stealer malware operation suspended after key developer killed in Ukraine invasion.Kaspersky pose “unacceptable risk” as the Russian security giant is removed from bug bounty programs.Lapsus$ return from vacation, and take arrests in stride releasing 70gb of data stolen from Globant.

Chinese security researcher accidentally releases spring framework PoC exploit.Raccoon stealer malware operation suspended after key developer killed in Ukraine invasion.Kaspersky pose “unacceptable risk” as the Russian security giant is removed from bug bounty programs.Lapsus$ return from vacation, and take arrests in stride releasing 70gb of data stolen from Globant.

Threat Bulletin #163

Open source software poisoned and turned into supply chain attack as anti war protest.Much newer functional version of Conti leaked online as revenge by Ukrainian member.Lapsus$ members arrested in London after more high profile hits over the last week.

Open source software poisoned and turned into supply chain attack as anti war protest.Much newer functional version of Conti leaked online as revenge by Ukrainian member.Lapsus$ members arrested in London after more high profile hits over the last week.

Threat Bulletin #162

In this weeks episode, the arrest and extradition of a NetWalker ransomware affiliate, the exploitation of unskilled Ukrainian hackers and finally, a campaign which suggests China may be helping Russia in their cyber efforts towards the conflict.

In this weeks episode, the arrest and extradition of a NetWalker ransomware affiliate, the exploitation of unskilled Ukrainian hackers and finally, a campaign which suggests China may be helping Russia in their cyber efforts towards the conflict.

Threat Bulletin #161

Hosted by Talion's in-house Threat Intelligence team, this special Threat Set Radio podcast episode covers some of the specific threats Higher Education is facing:·         BotNet targeting Higher Education·         Log4Shell exploit·         Recent Ransomware attacks on Higher Education

Hosted by Talion's in-house Threat Intelligence team, this special Threat Set Radio podcast episode covers some of the specific threats Higher Education is facing:·         BotNet targeting Higher Education·         Log4Shell exploit·         Recent Ransomware attacks on Higher Education

Threat Set Radio - Education Podcast

Cybersecurity news regarding the ongoing Russian invasion of Ukraine rundown.Certificates obtained from Nvidia leak used to sign malware.Lapsus$ breaches Samsung shortly after the Nvidia attack.

Cybersecurity news regarding the ongoing Russian invasion of Ukraine rundown.Certificates obtained from Nvidia leak used to sign malware.Lapsus$ breaches Samsung shortly after the Nvidia attack.

Threat Bulletin #160

Talion Threat Set Radio

The best philosophy podcast episodes. Asking questions about how to live a better life, what it means to be and do good, to the idea of God. This topic includes episodes that bring about important questions that everyone should be asking themselves. Add episodes you're interested into your queue below!

Best Episodes on Practical Philosophy & How To Live

The Best Multi-Part Documentaries, with documentaries on Obama, Federer vs Nadal, the making of Star Wars, Netflix vs Blockbuster and more. Add episodes you're interested into your queue below!